Edit tour

Windows Analysis Report
0Hw4Pw6xRd.exe

Overview

General Information

Sample name:	0Hw4Pw6xRd.exe renamed because original name is a hash value
Original sample name:	2574a99020c51b1f9b1b5298d810cf901c6e8740fcf550bd1292bdf381c40b8d.exe
Analysis ID:	1617792
MD5:	e02dcad7ceecf3e8a1982d32492951a8
SHA1:	f97210925891bbfc0bd79cdc984238217f1e41ba
SHA256:	2574a99020c51b1f9b1b5298d810cf901c6e8740fcf550bd1292bdf381c40b8d
Tags:	92-255-85-36exeuser-JAMESWT_MHT
Infos:

Detection

RedLine, SectopRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

Yara detected SectopRAT

Connects to many ports of the same IP (likely port scanning)

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

0Hw4Pw6xRd.exe (PID: 6532 cmdline: "C:\Users\user\Desktop\0Hw4Pw6xRd.exe" MD5: E02DCAD7CEECF3E8A1982D32492951A8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
0Hw4Pw6xRd.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0Hw4Pw6xRd.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0Hw4Pw6xRd.exe	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb5026:$s14: keybd_event 0xbbf88:$v1_1: grabber@ 0xb5be2:$v1_2: <BrowserProfile>k__ 0xb666f:$v1_3: <SystemHardwares>k__ 0xb672e:$v1_5: <ScannedWallets>k__ 0xb67be:$v1_6: <DicrFiles>k__ 0xb679a:$v1_7: <MessageClientFiles>k__ 0xb6b64:$v1_8: <ScanBrowsers>k__BackingField 0xb6bb6:$v1_8: <ScanWallets>k__BackingField 0xb6bd3:$v1_8: <ScanScreen>k__BackingField 0xb6c0d:$v1_8: <ScanVPN>k__BackingField 0xa8542:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7e4e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2076261192.0000000000752000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2076261192.0000000000752000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.0Hw4Pw6xRd.exe.750000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.0Hw4Pw6xRd.exe.750000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.0Hw4Pw6xRd.exe.750000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb5026:$s14: keybd_event 0xbbf88:$v1_1: grabber@ 0xb5be2:$v1_2: <BrowserProfile>k__ 0xb666f:$v1_3: <SystemHardwares>k__ 0xb672e:$v1_5: <ScannedWallets>k__ 0xb67be:$v1_6: <DicrFiles>k__ 0xb679a:$v1_7: <MessageClientFiles>k__ 0xb6b64:$v1_8: <ScanBrowsers>k__BackingField 0xb6bb6:$v1_8: <ScanWallets>k__BackingField 0xb6bd3:$v1_8: <ScanScreen>k__BackingField 0xb6c0d:$v1_8: <ScanVPN>k__BackingField 0xa8542:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7e4e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:50:13.290607+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49705	92.255.85.36	9000	TCP
2025-02-18T08:50:14.107522+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49706	92.255.85.36	9000	TCP
2025-02-18T08:50:14.971613+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49707	92.255.85.36	9000	TCP
2025-02-18T08:50:15.814854+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49708	92.255.85.36	9000	TCP
2025-02-18T08:50:16.639132+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49709	92.255.85.36	9000	TCP
2025-02-18T08:50:17.475943+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49710	92.255.85.36	9000	TCP
2025-02-18T08:50:18.271667+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49711	92.255.85.36	9000	TCP
2025-02-18T08:50:19.087308+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49712	92.255.85.36	9000	TCP
2025-02-18T08:50:19.881325+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49713	92.255.85.36	9000	TCP
2025-02-18T08:50:20.694334+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49714	92.255.85.36	9000	TCP
2025-02-18T08:50:21.509844+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49715	92.255.85.36	9000	TCP
2025-02-18T08:50:22.303067+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49716	92.255.85.36	9000	TCP
2025-02-18T08:50:23.100426+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49717	92.255.85.36	9000	TCP
2025-02-18T08:50:23.895344+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49719	92.255.85.36	9000	TCP
2025-02-18T08:50:24.690857+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49725	92.255.85.36	9000	TCP
2025-02-18T08:50:25.509692+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49731	92.255.85.36	9000	TCP
2025-02-18T08:50:26.303794+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49737	92.255.85.36	9000	TCP
2025-02-18T08:50:27.136469+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49744	92.255.85.36	9000	TCP
2025-02-18T08:50:27.929821+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49752	92.255.85.36	9000	TCP
2025-02-18T08:50:28.920913+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49760	92.255.85.36	9000	TCP
2025-02-18T08:50:29.733093+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49767	92.255.85.36	9000	TCP
2025-02-18T08:50:30.535466+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49773	92.255.85.36	9000	TCP
2025-02-18T08:50:31.334895+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49779	92.255.85.36	9000	TCP
2025-02-18T08:50:32.139456+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49785	92.255.85.36	9000	TCP
2025-02-18T08:50:32.991340+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49791	92.255.85.36	9000	TCP
2025-02-18T08:50:33.806211+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49797	92.255.85.36	9000	TCP
2025-02-18T08:50:34.627961+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49803	92.255.85.36	9000	TCP
2025-02-18T08:50:35.437975+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49809	92.255.85.36	9000	TCP
2025-02-18T08:50:36.260295+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49815	92.255.85.36	9000	TCP
2025-02-18T08:50:37.072684+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49821	92.255.85.36	9000	TCP
2025-02-18T08:50:37.886639+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49827	92.255.85.36	9000	TCP
2025-02-18T08:50:38.688903+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49833	92.255.85.36	9000	TCP
2025-02-18T08:50:39.491360+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49839	92.255.85.36	9000	TCP
2025-02-18T08:50:40.306580+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49845	92.255.85.36	9000	TCP
2025-02-18T08:50:41.101277+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49851	92.255.85.36	9000	TCP
2025-02-18T08:50:41.920407+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49857	92.255.85.36	9000	TCP
2025-02-18T08:50:42.741763+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49864	92.255.85.36	9000	TCP
2025-02-18T08:50:43.543337+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49870	92.255.85.36	9000	TCP
2025-02-18T08:50:44.334495+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49876	92.255.85.36	9000	TCP
2025-02-18T08:50:45.131103+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49882	92.255.85.36	9000	TCP
2025-02-18T08:50:48.966801+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49888	92.255.85.36	9000	TCP
2025-02-18T08:50:49.770004+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49914	92.255.85.36	9000	TCP
2025-02-18T08:50:50.599632+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49920	92.255.85.36	9000	TCP
2025-02-18T08:50:51.394554+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49926	92.255.85.36	9000	TCP
2025-02-18T08:50:52.193336+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49932	92.255.85.36	9000	TCP
2025-02-18T08:50:53.001368+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49938	92.255.85.36	9000	TCP
2025-02-18T08:50:53.812373+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49944	92.255.85.36	9000	TCP
2025-02-18T08:50:54.615999+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49950	92.255.85.36	9000	TCP
2025-02-18T08:50:55.409770+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49956	92.255.85.36	9000	TCP
2025-02-18T08:50:56.217466+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49962	92.255.85.36	9000	TCP
2025-02-18T08:50:57.027653+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49968	92.255.85.36	9000	TCP
2025-02-18T08:50:57.844724+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49974	92.255.85.36	9000	TCP
2025-02-18T08:50:58.656896+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49981	92.255.85.36	9000	TCP
2025-02-18T08:50:59.466447+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49987	92.255.85.36	9000	TCP
2025-02-18T08:51:00.259635+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49994	92.255.85.36	9000	TCP
2025-02-18T08:51:01.050720+0100	2052248	1	A Network Trojan was detected	192.168.2.5	49999	92.255.85.36	9000	TCP
2025-02-18T08:51:01.848983+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50006	92.255.85.36	9000	TCP
2025-02-18T08:51:02.651848+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50013	92.255.85.36	9000	TCP
2025-02-18T08:51:03.444808+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50016	92.255.85.36	9000	TCP
2025-02-18T08:51:04.265184+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50023	92.255.85.36	9000	TCP
2025-02-18T08:51:05.080897+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50031	92.255.85.36	9000	TCP
2025-02-18T08:51:05.880136+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50037	92.255.85.36	9000	TCP
2025-02-18T08:51:06.711153+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50039	92.255.85.36	9000	TCP
2025-02-18T08:51:07.525291+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50040	92.255.85.36	9000	TCP
2025-02-18T08:51:08.330038+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50041	92.255.85.36	9000	TCP
2025-02-18T08:51:09.135003+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50042	92.255.85.36	9000	TCP
2025-02-18T08:51:09.927631+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50043	92.255.85.36	9000	TCP
2025-02-18T08:51:10.743497+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50044	92.255.85.36	9000	TCP
2025-02-18T08:51:11.561877+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50045	92.255.85.36	9000	TCP
2025-02-18T08:51:12.383742+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50046	92.255.85.36	9000	TCP
2025-02-18T08:51:13.205425+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50047	92.255.85.36	9000	TCP
2025-02-18T08:51:14.009240+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50048	92.255.85.36	9000	TCP
2025-02-18T08:51:14.823556+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50049	92.255.85.36	9000	TCP
2025-02-18T08:51:15.617913+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50050	92.255.85.36	9000	TCP
2025-02-18T08:51:16.419871+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50051	92.255.85.36	9000	TCP
2025-02-18T08:51:17.228989+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50052	92.255.85.36	9000	TCP
2025-02-18T08:51:18.027189+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50053	92.255.85.36	9000	TCP
2025-02-18T08:51:18.818736+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50054	92.255.85.36	9000	TCP
2025-02-18T08:51:19.616839+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50055	92.255.85.36	9000	TCP
2025-02-18T08:51:20.524402+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50057	92.255.85.36	9000	TCP
2025-02-18T08:51:21.327079+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50058	92.255.85.36	9000	TCP
2025-02-18T08:51:22.148846+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50059	92.255.85.36	9000	TCP
2025-02-18T08:51:22.973141+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50060	92.255.85.36	9000	TCP
2025-02-18T08:51:23.775989+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50061	92.255.85.36	9000	TCP
2025-02-18T08:51:24.770028+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50062	92.255.85.36	9000	TCP
2025-02-18T08:51:25.567210+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50064	92.255.85.36	9000	TCP
2025-02-18T08:51:26.364208+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50065	92.255.85.36	9000	TCP
2025-02-18T08:51:27.312883+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50066	92.255.85.36	9000	TCP
2025-02-18T08:51:28.115761+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50067	92.255.85.36	9000	TCP
2025-02-18T08:51:28.920904+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50068	92.255.85.36	9000	TCP
2025-02-18T08:51:29.728916+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50069	92.255.85.36	9000	TCP
2025-02-18T08:51:30.539276+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50071	92.255.85.36	9000	TCP
2025-02-18T08:51:31.346982+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50072	92.255.85.36	9000	TCP
2025-02-18T08:51:32.148867+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50073	92.255.85.36	9000	TCP
2025-02-18T08:51:32.976512+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50075	92.255.85.36	9000	TCP
2025-02-18T08:51:33.781460+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50076	92.255.85.36	9000	TCP
2025-02-18T08:51:34.602045+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50077	92.255.85.36	9000	TCP
2025-02-18T08:51:35.395792+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50078	92.255.85.36	9000	TCP
2025-02-18T08:51:36.203429+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50079	92.255.85.36	9000	TCP
2025-02-18T08:51:37.006054+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50080	92.255.85.36	9000	TCP
2025-02-18T08:51:37.821161+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50081	92.255.85.36	9000	TCP
2025-02-18T08:51:38.625598+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50082	92.255.85.36	9000	TCP
2025-02-18T08:51:39.433439+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50083	92.255.85.36	9000	TCP
2025-02-18T08:51:40.224067+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50084	92.255.85.36	9000	TCP
2025-02-18T08:51:41.027003+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50085	92.255.85.36	9000	TCP
2025-02-18T08:51:41.832270+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50086	92.255.85.36	9000	TCP
2025-02-18T08:51:42.633281+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50087	92.255.85.36	9000	TCP
2025-02-18T08:51:43.555003+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50088	92.255.85.36	9000	TCP
2025-02-18T08:51:44.350358+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50089	92.255.85.36	9000	TCP
2025-02-18T08:51:45.147894+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50090	92.255.85.36	9000	TCP
2025-02-18T08:51:46.053946+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50091	92.255.85.36	9000	TCP
2025-02-18T08:51:46.858862+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50092	92.255.85.36	9000	TCP
2025-02-18T08:51:47.683218+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50093	92.255.85.36	9000	TCP
2025-02-18T08:51:48.755151+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50094	92.255.85.36	9000	TCP
2025-02-18T08:51:49.554330+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50095	92.255.85.36	9000	TCP
2025-02-18T08:51:50.361165+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50096	92.255.85.36	9000	TCP
2025-02-18T08:51:51.192276+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50097	92.255.85.36	9000	TCP
2025-02-18T08:51:51.994537+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50098	92.255.85.36	9000	TCP
2025-02-18T08:51:52.804207+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50099	92.255.85.36	9000	TCP
2025-02-18T08:51:53.619504+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50100	92.255.85.36	9000	TCP
2025-02-18T08:51:54.431392+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50101	92.255.85.36	9000	TCP
2025-02-18T08:51:55.233547+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50102	92.255.85.36	9000	TCP
2025-02-18T08:51:56.049989+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50103	92.255.85.36	9000	TCP
2025-02-18T08:51:56.866190+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50104	92.255.85.36	9000	TCP
2025-02-18T08:51:57.671122+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50105	92.255.85.36	9000	TCP
2025-02-18T08:51:58.477466+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50106	92.255.85.36	9000	TCP
2025-02-18T08:51:59.271042+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50107	92.255.85.36	9000	TCP
2025-02-18T08:52:00.080134+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50108	92.255.85.36	9000	TCP
2025-02-18T08:52:00.900901+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50109	92.255.85.36	9000	TCP
2025-02-18T08:52:01.693972+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50110	92.255.85.36	9000	TCP
2025-02-18T08:52:02.506415+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50111	92.255.85.36	9000	TCP
2025-02-18T08:52:03.336098+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50112	92.255.85.36	9000	TCP
2025-02-18T08:52:04.139944+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50113	92.255.85.36	9000	TCP
2025-02-18T08:52:04.942614+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50114	92.255.85.36	9000	TCP
2025-02-18T08:52:05.770421+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50115	92.255.85.36	9000	TCP
2025-02-18T08:52:06.584824+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50116	92.255.85.36	9000	TCP
2025-02-18T08:52:07.391871+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50117	92.255.85.36	9000	TCP
2025-02-18T08:52:08.231016+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50118	92.255.85.36	9000	TCP
2025-02-18T08:52:09.042281+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50119	92.255.85.36	9000	TCP
2025-02-18T08:52:09.839476+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50120	92.255.85.36	9000	TCP
2025-02-18T08:52:10.671319+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50121	92.255.85.36	9000	TCP
2025-02-18T08:52:11.475906+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50123	92.255.85.36	9000	TCP
2025-02-18T08:52:12.300982+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50124	92.255.85.36	9000	TCP
2025-02-18T08:52:13.119414+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50125	92.255.85.36	9000	TCP
2025-02-18T08:52:13.969224+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50126	92.255.85.36	9000	TCP
2025-02-18T08:52:14.780113+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50127	92.255.85.36	9000	TCP
2025-02-18T08:52:15.587611+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50128	92.255.85.36	9000	TCP
2025-02-18T08:52:16.403838+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50129	92.255.85.36	9000	TCP
2025-02-18T08:52:17.192862+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50130	92.255.85.36	9000	TCP
2025-02-18T08:52:18.008347+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50131	92.255.85.36	9000	TCP
2025-02-18T08:52:18.820506+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50132	92.255.85.36	9000	TCP
2025-02-18T08:52:19.614488+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50133	92.255.85.36	9000	TCP
2025-02-18T08:52:20.429338+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50134	92.255.85.36	9000	TCP
2025-02-18T08:52:21.244571+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50135	92.255.85.36	9000	TCP
2025-02-18T08:52:22.081389+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50136	92.255.85.36	9000	TCP
2025-02-18T08:52:22.908848+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50137	92.255.85.36	9000	TCP
2025-02-18T08:52:23.730577+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50138	92.255.85.36	9000	TCP
2025-02-18T08:52:24.536801+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50139	92.255.85.36	9000	TCP
2025-02-18T08:52:25.365172+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50140	92.255.85.36	9000	TCP
2025-02-18T08:52:26.198146+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50141	92.255.85.36	9000	TCP
2025-02-18T08:52:26.994431+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50142	92.255.85.36	9000	TCP
2025-02-18T08:52:27.816968+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50143	92.255.85.36	9000	TCP
2025-02-18T08:52:28.615879+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50144	92.255.85.36	9000	TCP
2025-02-18T08:52:29.459988+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50145	92.255.85.36	9000	TCP
2025-02-18T08:52:30.257474+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50146	92.255.85.36	9000	TCP
2025-02-18T08:52:31.061241+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50147	92.255.85.36	9000	TCP
2025-02-18T08:52:31.869018+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50148	92.255.85.36	9000	TCP
2025-02-18T08:52:32.720274+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50149	92.255.85.36	9000	TCP
2025-02-18T08:52:33.543445+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50150	92.255.85.36	9000	TCP
2025-02-18T08:52:34.340559+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50151	92.255.85.36	9000	TCP
2025-02-18T08:52:35.136111+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50152	92.255.85.36	9000	TCP
2025-02-18T08:52:35.936377+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50153	92.255.85.36	9000	TCP
2025-02-18T08:52:36.790309+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50154	92.255.85.36	9000	TCP
2025-02-18T08:52:37.585168+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50155	92.255.85.36	9000	TCP
2025-02-18T08:52:38.395295+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50156	92.255.85.36	9000	TCP
2025-02-18T08:52:39.197669+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50157	92.255.85.36	9000	TCP
2025-02-18T08:52:39.991564+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50158	92.255.85.36	9000	TCP
2025-02-18T08:52:40.788318+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50159	92.255.85.36	9000	TCP
2025-02-18T08:52:41.590645+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50160	92.255.85.36	9000	TCP
2025-02-18T08:52:42.378779+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50161	92.255.85.36	9000	TCP
2025-02-18T08:52:43.179211+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50162	92.255.85.36	9000	TCP
2025-02-18T08:52:44.007810+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50163	92.255.85.36	9000	TCP
2025-02-18T08:52:45.004970+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50164	92.255.85.36	9000	TCP
2025-02-18T08:52:45.829112+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50165	92.255.85.36	9000	TCP
2025-02-18T08:52:46.653310+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50166	92.255.85.36	9000	TCP
2025-02-18T08:52:47.556210+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50167	92.255.85.36	9000	TCP
2025-02-18T08:52:48.459007+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50169	92.255.85.36	9000	TCP
2025-02-18T08:52:49.266572+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50170	92.255.85.36	9000	TCP
2025-02-18T08:52:50.314798+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50171	92.255.85.36	9000	TCP
2025-02-18T08:52:51.123033+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50172	92.255.85.36	9000	TCP
2025-02-18T08:52:51.935769+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50173	92.255.85.36	9000	TCP
2025-02-18T08:52:52.748261+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50174	92.255.85.36	9000	TCP
2025-02-18T08:52:53.553333+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50175	92.255.85.36	9000	TCP
2025-02-18T08:52:54.369239+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50176	92.255.85.36	9000	TCP
2025-02-18T08:52:55.276549+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50177	92.255.85.36	9000	TCP
2025-02-18T08:52:56.067498+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50178	92.255.85.36	9000	TCP
2025-02-18T08:52:56.876530+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50179	92.255.85.36	9000	TCP
2025-02-18T08:52:57.882486+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50180	92.255.85.36	9000	TCP
2025-02-18T08:52:58.780551+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50181	92.255.85.36	9000	TCP
2025-02-18T08:52:59.585330+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50182	92.255.85.36	9000	TCP
2025-02-18T08:53:00.390907+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50183	92.255.85.36	9000	TCP
2025-02-18T08:53:01.207699+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50184	92.255.85.36	9000	TCP
2025-02-18T08:53:02.041664+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50185	92.255.85.36	9000	TCP
2025-02-18T08:53:02.861836+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50186	92.255.85.36	9000	TCP
2025-02-18T08:53:03.671950+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50187	92.255.85.36	9000	TCP
2025-02-18T08:53:04.486933+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50188	92.255.85.36	9000	TCP
2025-02-18T08:53:05.287664+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50189	92.255.85.36	9000	TCP
2025-02-18T08:53:06.093663+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50190	92.255.85.36	9000	TCP
2025-02-18T08:53:06.897975+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50191	92.255.85.36	9000	TCP
2025-02-18T08:53:07.702895+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50192	92.255.85.36	9000	TCP
2025-02-18T08:53:08.508485+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50193	92.255.85.36	9000	TCP
2025-02-18T08:53:09.310890+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50194	92.255.85.36	9000	TCP
2025-02-18T08:53:10.139917+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50195	92.255.85.36	9000	TCP
2025-02-18T08:53:10.953953+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50196	92.255.85.36	9000	TCP
2025-02-18T08:53:11.772152+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50197	92.255.85.36	9000	TCP
2025-02-18T08:53:12.613097+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50198	92.255.85.36	9000	TCP
2025-02-18T08:53:13.414077+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50199	92.255.85.36	9000	TCP
2025-02-18T08:53:14.208688+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50200	92.255.85.36	9000	TCP
2025-02-18T08:53:15.027602+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50201	92.255.85.36	9000	TCP
2025-02-18T08:53:15.833680+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50202	92.255.85.36	9000	TCP
2025-02-18T08:53:16.629639+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50203	92.255.85.36	9000	TCP
2025-02-18T08:53:17.448311+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50204	92.255.85.36	9000	TCP
2025-02-18T08:53:18.245816+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50205	92.255.85.36	9000	TCP
2025-02-18T08:53:19.051197+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50207	92.255.85.36	9000	TCP
2025-02-18T08:53:19.872658+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50208	92.255.85.36	9000	TCP
2025-02-18T08:53:20.722041+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50209	92.255.85.36	9000	TCP
2025-02-18T08:53:21.543773+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50210	92.255.85.36	9000	TCP
2025-02-18T08:53:22.353998+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50211	92.255.85.36	9000	TCP
2025-02-18T08:53:23.149676+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50212	92.255.85.36	9000	TCP
2025-02-18T08:53:23.951121+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50213	92.255.85.36	9000	TCP
2025-02-18T08:53:24.779088+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50214	92.255.85.36	9000	TCP
2025-02-18T08:53:25.601705+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50215	92.255.85.36	9000	TCP
2025-02-18T08:53:26.425446+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50216	92.255.85.36	9000	TCP
2025-02-18T08:53:27.231347+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50217	92.255.85.36	9000	TCP
2025-02-18T08:53:28.038754+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50218	92.255.85.36	9000	TCP
2025-02-18T08:53:28.844092+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50219	92.255.85.36	9000	TCP
2025-02-18T08:53:29.649165+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50220	92.255.85.36	9000	TCP
2025-02-18T08:53:30.454726+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50221	92.255.85.36	9000	TCP
2025-02-18T08:53:31.276596+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50222	92.255.85.36	9000	TCP
2025-02-18T08:53:32.089213+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50223	92.255.85.36	9000	TCP
2025-02-18T08:53:32.903272+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50224	92.255.85.36	9000	TCP
2025-02-18T08:53:33.721939+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50225	92.255.85.36	9000	TCP
2025-02-18T08:53:34.525517+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50226	92.255.85.36	9000	TCP
2025-02-18T08:53:35.347228+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50227	92.255.85.36	9000	TCP
2025-02-18T08:53:36.168269+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50228	92.255.85.36	9000	TCP
2025-02-18T08:53:36.986957+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50229	92.255.85.36	9000	TCP
2025-02-18T08:53:37.790046+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50230	92.255.85.36	9000	TCP
2025-02-18T08:53:38.605615+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50231	92.255.85.36	9000	TCP
2025-02-18T08:53:39.406191+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50232	92.255.85.36	9000	TCP
2025-02-18T08:53:40.236453+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50233	92.255.85.36	9000	TCP
2025-02-18T08:53:41.046411+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50234	92.255.85.36	9000	TCP
2025-02-18T08:53:41.888415+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50235	92.255.85.36	9000	TCP
2025-02-18T08:53:42.724871+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50236	92.255.85.36	9000	TCP
2025-02-18T08:53:43.524978+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50237	92.255.85.36	9000	TCP
2025-02-18T08:53:44.331187+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50238	92.255.85.36	9000	TCP
2025-02-18T08:53:45.149314+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50239	92.255.85.36	9000	TCP
2025-02-18T08:53:45.964836+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50240	92.255.85.36	9000	TCP
2025-02-18T08:53:46.801279+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50241	92.255.85.36	9000	TCP
2025-02-18T08:53:47.610084+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50242	92.255.85.36	9000	TCP
2025-02-18T08:53:48.418235+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50243	92.255.85.36	9000	TCP
2025-02-18T08:53:49.228169+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50244	92.255.85.36	9000	TCP
2025-02-18T08:53:50.035974+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50245	92.255.85.36	9000	TCP
2025-02-18T08:53:50.853226+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50246	92.255.85.36	9000	TCP
2025-02-18T08:53:51.654679+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50247	92.255.85.36	9000	TCP
2025-02-18T08:53:52.473898+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50248	92.255.85.36	9000	TCP
2025-02-18T08:53:53.291706+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50249	92.255.85.36	9000	TCP
2025-02-18T08:53:54.109952+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50250	92.255.85.36	9000	TCP
2025-02-18T08:53:54.937280+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50251	92.255.85.36	9000	TCP
2025-02-18T08:53:55.739796+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50252	92.255.85.36	9000	TCP
2025-02-18T08:53:56.566732+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50253	92.255.85.36	9000	TCP
2025-02-18T08:53:57.365707+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50254	92.255.85.36	9000	TCP
2025-02-18T08:53:58.180945+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50255	92.255.85.36	9000	TCP
2025-02-18T08:53:58.975743+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50256	92.255.85.36	9000	TCP
2025-02-18T08:53:59.774767+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50257	92.255.85.36	9000	TCP
2025-02-18T08:54:00.695333+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50258	92.255.85.36	9000	TCP
2025-02-18T08:54:01.497891+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50259	92.255.85.36	9000	TCP
2025-02-18T08:54:02.321277+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50260	92.255.85.36	9000	TCP
2025-02-18T08:54:03.164797+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50261	92.255.85.36	9000	TCP
2025-02-18T08:54:03.970082+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50262	92.255.85.36	9000	TCP
2025-02-18T08:54:04.774938+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50263	92.255.85.36	9000	TCP
2025-02-18T08:54:05.700185+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50264	92.255.85.36	9000	TCP
2025-02-18T08:54:06.497280+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50265	92.255.85.36	9000	TCP
2025-02-18T08:54:07.415423+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50266	92.255.85.36	9000	TCP
2025-02-18T08:54:08.207520+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50267	92.255.85.36	9000	TCP
2025-02-18T08:54:09.004247+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50269	92.255.85.36	9000	TCP
2025-02-18T08:54:09.806913+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50270	92.255.85.36	9000	TCP
2025-02-18T08:54:10.611649+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50271	92.255.85.36	9000	TCP
2025-02-18T08:54:11.416017+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50272	92.255.85.36	9000	TCP
2025-02-18T08:54:12.206896+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50273	92.255.85.36	9000	TCP
2025-02-18T08:54:13.018601+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50274	92.255.85.36	9000	TCP
2025-02-18T08:54:13.816770+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50275	92.255.85.36	9000	TCP
2025-02-18T08:54:14.713513+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50276	92.255.85.36	9000	TCP
2025-02-18T08:54:15.505418+0100	2052248	1	A Network Trojan was detected	192.168.2.5	50277	92.255.85.36	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T08:50:14.107522+0100	2803305	3	Unknown Traffic	192.168.2.5	49706	92.255.85.36	9000	TCP
2025-02-18T08:50:15.814854+0100	2803305	3	Unknown Traffic	192.168.2.5	49708	92.255.85.36	9000	TCP
2025-02-18T08:50:20.694334+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	92.255.85.36	9000	TCP
2025-02-18T08:50:23.100426+0100	2803305	3	Unknown Traffic	192.168.2.5	49717	92.255.85.36	9000	TCP
2025-02-18T08:50:24.690857+0100	2803305	3	Unknown Traffic	192.168.2.5	49725	92.255.85.36	9000	TCP
2025-02-18T08:50:26.303794+0100	2803305	3	Unknown Traffic	192.168.2.5	49737	92.255.85.36	9000	TCP
2025-02-18T08:50:27.136469+0100	2803305	3	Unknown Traffic	192.168.2.5	49744	92.255.85.36	9000	TCP
2025-02-18T08:50:28.920913+0100	2803305	3	Unknown Traffic	192.168.2.5	49760	92.255.85.36	9000	TCP
2025-02-18T08:50:29.733093+0100	2803305	3	Unknown Traffic	192.168.2.5	49767	92.255.85.36	9000	TCP
2025-02-18T08:50:31.334895+0100	2803305	3	Unknown Traffic	192.168.2.5	49779	92.255.85.36	9000	TCP
2025-02-18T08:50:34.627961+0100	2803305	3	Unknown Traffic	192.168.2.5	49803	92.255.85.36	9000	TCP
2025-02-18T08:50:36.260295+0100	2803305	3	Unknown Traffic	192.168.2.5	49815	92.255.85.36	9000	TCP
2025-02-18T08:50:37.072684+0100	2803305	3	Unknown Traffic	192.168.2.5	49821	92.255.85.36	9000	TCP
2025-02-18T08:50:37.886639+0100	2803305	3	Unknown Traffic	192.168.2.5	49827	92.255.85.36	9000	TCP
2025-02-18T08:50:41.920407+0100	2803305	3	Unknown Traffic	192.168.2.5	49857	92.255.85.36	9000	TCP
2025-02-18T08:50:42.741763+0100	2803305	3	Unknown Traffic	192.168.2.5	49864	92.255.85.36	9000	TCP
2025-02-18T08:50:43.543337+0100	2803305	3	Unknown Traffic	192.168.2.5	49870	92.255.85.36	9000	TCP
2025-02-18T08:50:44.334495+0100	2803305	3	Unknown Traffic	192.168.2.5	49876	92.255.85.36	9000	TCP
2025-02-18T08:50:45.131103+0100	2803305	3	Unknown Traffic	192.168.2.5	49882	92.255.85.36	9000	TCP
2025-02-18T08:50:48.966801+0100	2803305	3	Unknown Traffic	192.168.2.5	49888	92.255.85.36	9000	TCP
2025-02-18T08:50:54.615999+0100	2803305	3	Unknown Traffic	192.168.2.5	49950	92.255.85.36	9000	TCP
2025-02-18T08:50:57.027653+0100	2803305	3	Unknown Traffic	192.168.2.5	49968	92.255.85.36	9000	TCP
2025-02-18T08:50:59.466447+0100	2803305	3	Unknown Traffic	192.168.2.5	49987	92.255.85.36	9000	TCP
2025-02-18T08:51:01.050720+0100	2803305	3	Unknown Traffic	192.168.2.5	49999	92.255.85.36	9000	TCP
2025-02-18T08:51:01.848983+0100	2803305	3	Unknown Traffic	192.168.2.5	50006	92.255.85.36	9000	TCP
2025-02-18T08:51:03.444808+0100	2803305	3	Unknown Traffic	192.168.2.5	50016	92.255.85.36	9000	TCP
2025-02-18T08:51:05.080897+0100	2803305	3	Unknown Traffic	192.168.2.5	50031	92.255.85.36	9000	TCP
2025-02-18T08:51:06.711153+0100	2803305	3	Unknown Traffic	192.168.2.5	50039	92.255.85.36	9000	TCP
2025-02-18T08:51:11.561877+0100	2803305	3	Unknown Traffic	192.168.2.5	50045	92.255.85.36	9000	TCP
2025-02-18T08:51:14.009240+0100	2803305	3	Unknown Traffic	192.168.2.5	50048	92.255.85.36	9000	TCP
2025-02-18T08:51:21.327079+0100	2803305	3	Unknown Traffic	192.168.2.5	50058	92.255.85.36	9000	TCP
2025-02-18T08:51:23.775989+0100	2803305	3	Unknown Traffic	192.168.2.5	50061	92.255.85.36	9000	TCP
2025-02-18T08:51:24.770028+0100	2803305	3	Unknown Traffic	192.168.2.5	50062	92.255.85.36	9000	TCP
2025-02-18T08:51:25.567210+0100	2803305	3	Unknown Traffic	192.168.2.5	50064	92.255.85.36	9000	TCP
2025-02-18T08:51:26.364208+0100	2803305	3	Unknown Traffic	192.168.2.5	50065	92.255.85.36	9000	TCP
2025-02-18T08:51:29.728916+0100	2803305	3	Unknown Traffic	192.168.2.5	50069	92.255.85.36	9000	TCP
2025-02-18T08:51:30.539276+0100	2803305	3	Unknown Traffic	192.168.2.5	50071	92.255.85.36	9000	TCP
2025-02-18T08:51:31.346982+0100	2803305	3	Unknown Traffic	192.168.2.5	50072	92.255.85.36	9000	TCP
2025-02-18T08:51:33.781460+0100	2803305	3	Unknown Traffic	192.168.2.5	50076	92.255.85.36	9000	TCP
2025-02-18T08:51:34.602045+0100	2803305	3	Unknown Traffic	192.168.2.5	50077	92.255.85.36	9000	TCP
2025-02-18T08:51:35.395792+0100	2803305	3	Unknown Traffic	192.168.2.5	50078	92.255.85.36	9000	TCP
2025-02-18T08:51:36.203429+0100	2803305	3	Unknown Traffic	192.168.2.5	50079	92.255.85.36	9000	TCP
2025-02-18T08:51:41.027003+0100	2803305	3	Unknown Traffic	192.168.2.5	50085	92.255.85.36	9000	TCP
2025-02-18T08:51:42.633281+0100	2803305	3	Unknown Traffic	192.168.2.5	50087	92.255.85.36	9000	TCP
2025-02-18T08:51:44.350358+0100	2803305	3	Unknown Traffic	192.168.2.5	50089	92.255.85.36	9000	TCP
2025-02-18T08:51:46.053946+0100	2803305	3	Unknown Traffic	192.168.2.5	50091	92.255.85.36	9000	TCP
2025-02-18T08:51:48.755151+0100	2803305	3	Unknown Traffic	192.168.2.5	50094	92.255.85.36	9000	TCP
2025-02-18T08:51:51.994537+0100	2803305	3	Unknown Traffic	192.168.2.5	50098	92.255.85.36	9000	TCP
2025-02-18T08:51:55.233547+0100	2803305	3	Unknown Traffic	192.168.2.5	50102	92.255.85.36	9000	TCP
2025-02-18T08:51:56.866190+0100	2803305	3	Unknown Traffic	192.168.2.5	50104	92.255.85.36	9000	TCP
2025-02-18T08:52:00.900901+0100	2803305	3	Unknown Traffic	192.168.2.5	50109	92.255.85.36	9000	TCP
2025-02-18T08:52:01.693972+0100	2803305	3	Unknown Traffic	192.168.2.5	50110	92.255.85.36	9000	TCP
2025-02-18T08:52:02.506415+0100	2803305	3	Unknown Traffic	192.168.2.5	50111	92.255.85.36	9000	TCP
2025-02-18T08:52:04.139944+0100	2803305	3	Unknown Traffic	192.168.2.5	50113	92.255.85.36	9000	TCP
2025-02-18T08:52:07.391871+0100	2803305	3	Unknown Traffic	192.168.2.5	50117	92.255.85.36	9000	TCP
2025-02-18T08:52:09.042281+0100	2803305	3	Unknown Traffic	192.168.2.5	50119	92.255.85.36	9000	TCP
2025-02-18T08:52:12.300982+0100	2803305	3	Unknown Traffic	192.168.2.5	50124	92.255.85.36	9000	TCP
2025-02-18T08:52:13.119414+0100	2803305	3	Unknown Traffic	192.168.2.5	50125	92.255.85.36	9000	TCP
2025-02-18T08:52:18.820506+0100	2803305	3	Unknown Traffic	192.168.2.5	50132	92.255.85.36	9000	TCP
2025-02-18T08:52:19.614488+0100	2803305	3	Unknown Traffic	192.168.2.5	50133	92.255.85.36	9000	TCP
2025-02-18T08:52:22.908848+0100	2803305	3	Unknown Traffic	192.168.2.5	50137	92.255.85.36	9000	TCP
2025-02-18T08:52:23.730577+0100	2803305	3	Unknown Traffic	192.168.2.5	50138	92.255.85.36	9000	TCP
2025-02-18T08:52:25.365172+0100	2803305	3	Unknown Traffic	192.168.2.5	50140	92.255.85.36	9000	TCP
2025-02-18T08:52:31.061241+0100	2803305	3	Unknown Traffic	192.168.2.5	50147	92.255.85.36	9000	TCP
2025-02-18T08:52:31.869018+0100	2803305	3	Unknown Traffic	192.168.2.5	50148	92.255.85.36	9000	TCP
2025-02-18T08:52:32.720274+0100	2803305	3	Unknown Traffic	192.168.2.5	50149	92.255.85.36	9000	TCP
2025-02-18T08:52:35.936377+0100	2803305	3	Unknown Traffic	192.168.2.5	50153	92.255.85.36	9000	TCP
2025-02-18T08:52:37.585168+0100	2803305	3	Unknown Traffic	192.168.2.5	50155	92.255.85.36	9000	TCP
2025-02-18T08:52:39.991564+0100	2803305	3	Unknown Traffic	192.168.2.5	50158	92.255.85.36	9000	TCP
2025-02-18T08:52:40.788318+0100	2803305	3	Unknown Traffic	192.168.2.5	50159	92.255.85.36	9000	TCP
2025-02-18T08:52:41.590645+0100	2803305	3	Unknown Traffic	192.168.2.5	50160	92.255.85.36	9000	TCP
2025-02-18T08:52:42.378779+0100	2803305	3	Unknown Traffic	192.168.2.5	50161	92.255.85.36	9000	TCP
2025-02-18T08:52:44.007810+0100	2803305	3	Unknown Traffic	192.168.2.5	50163	92.255.85.36	9000	TCP
2025-02-18T08:52:45.004970+0100	2803305	3	Unknown Traffic	192.168.2.5	50164	92.255.85.36	9000	TCP
2025-02-18T08:52:45.829112+0100	2803305	3	Unknown Traffic	192.168.2.5	50165	92.255.85.36	9000	TCP
2025-02-18T08:52:47.556210+0100	2803305	3	Unknown Traffic	192.168.2.5	50167	92.255.85.36	9000	TCP
2025-02-18T08:52:49.266572+0100	2803305	3	Unknown Traffic	192.168.2.5	50170	92.255.85.36	9000	TCP
2025-02-18T08:52:50.314798+0100	2803305	3	Unknown Traffic	192.168.2.5	50171	92.255.85.36	9000	TCP
2025-02-18T08:52:52.748261+0100	2803305	3	Unknown Traffic	192.168.2.5	50174	92.255.85.36	9000	TCP
2025-02-18T08:52:56.067498+0100	2803305	3	Unknown Traffic	192.168.2.5	50178	92.255.85.36	9000	TCP
2025-02-18T08:52:58.780551+0100	2803305	3	Unknown Traffic	192.168.2.5	50181	92.255.85.36	9000	TCP
2025-02-18T08:53:01.207699+0100	2803305	3	Unknown Traffic	192.168.2.5	50184	92.255.85.36	9000	TCP
2025-02-18T08:53:02.041664+0100	2803305	3	Unknown Traffic	192.168.2.5	50185	92.255.85.36	9000	TCP
2025-02-18T08:53:04.486933+0100	2803305	3	Unknown Traffic	192.168.2.5	50188	92.255.85.36	9000	TCP
2025-02-18T08:53:05.287664+0100	2803305	3	Unknown Traffic	192.168.2.5	50189	92.255.85.36	9000	TCP
2025-02-18T08:53:06.093663+0100	2803305	3	Unknown Traffic	192.168.2.5	50190	92.255.85.36	9000	TCP
2025-02-18T08:53:09.310890+0100	2803305	3	Unknown Traffic	192.168.2.5	50194	92.255.85.36	9000	TCP
2025-02-18T08:53:13.414077+0100	2803305	3	Unknown Traffic	192.168.2.5	50199	92.255.85.36	9000	TCP
2025-02-18T08:53:15.027602+0100	2803305	3	Unknown Traffic	192.168.2.5	50201	92.255.85.36	9000	TCP
2025-02-18T08:53:16.629639+0100	2803305	3	Unknown Traffic	192.168.2.5	50203	92.255.85.36	9000	TCP
2025-02-18T08:53:19.872658+0100	2803305	3	Unknown Traffic	192.168.2.5	50208	92.255.85.36	9000	TCP
2025-02-18T08:53:22.353998+0100	2803305	3	Unknown Traffic	192.168.2.5	50211	92.255.85.36	9000	TCP
2025-02-18T08:53:24.779088+0100	2803305	3	Unknown Traffic	192.168.2.5	50214	92.255.85.36	9000	TCP
2025-02-18T08:53:26.425446+0100	2803305	3	Unknown Traffic	192.168.2.5	50216	92.255.85.36	9000	TCP
2025-02-18T08:53:28.038754+0100	2803305	3	Unknown Traffic	192.168.2.5	50218	92.255.85.36	9000	TCP
2025-02-18T08:53:28.844092+0100	2803305	3	Unknown Traffic	192.168.2.5	50219	92.255.85.36	9000	TCP
2025-02-18T08:53:31.276596+0100	2803305	3	Unknown Traffic	192.168.2.5	50222	92.255.85.36	9000	TCP
2025-02-18T08:53:32.089213+0100	2803305	3	Unknown Traffic	192.168.2.5	50223	92.255.85.36	9000	TCP
2025-02-18T08:53:33.721939+0100	2803305	3	Unknown Traffic	192.168.2.5	50225	92.255.85.36	9000	TCP
2025-02-18T08:53:34.525517+0100	2803305	3	Unknown Traffic	192.168.2.5	50226	92.255.85.36	9000	TCP
2025-02-18T08:53:37.790046+0100	2803305	3	Unknown Traffic	192.168.2.5	50230	92.255.85.36	9000	TCP
2025-02-18T08:53:38.605615+0100	2803305	3	Unknown Traffic	192.168.2.5	50231	92.255.85.36	9000	TCP
2025-02-18T08:53:43.524978+0100	2803305	3	Unknown Traffic	192.168.2.5	50237	92.255.85.36	9000	TCP
2025-02-18T08:53:46.801279+0100	2803305	3	Unknown Traffic	192.168.2.5	50241	92.255.85.36	9000	TCP
2025-02-18T08:53:51.654679+0100	2803305	3	Unknown Traffic	192.168.2.5	50247	92.255.85.36	9000	TCP
2025-02-18T08:53:54.937280+0100	2803305	3	Unknown Traffic	192.168.2.5	50251	92.255.85.36	9000	TCP
2025-02-18T08:53:55.739796+0100	2803305	3	Unknown Traffic	192.168.2.5	50252	92.255.85.36	9000	TCP
2025-02-18T08:53:58.180945+0100	2803305	3	Unknown Traffic	192.168.2.5	50255	92.255.85.36	9000	TCP
2025-02-18T08:53:59.774767+0100	2803305	3	Unknown Traffic	192.168.2.5	50257	92.255.85.36	9000	TCP
2025-02-18T08:54:01.497891+0100	2803305	3	Unknown Traffic	192.168.2.5	50259	92.255.85.36	9000	TCP
2025-02-18T08:54:03.164797+0100	2803305	3	Unknown Traffic	192.168.2.5	50261	92.255.85.36	9000	TCP
2025-02-18T08:54:08.207520+0100	2803305	3	Unknown Traffic	192.168.2.5	50267	92.255.85.36	9000	TCP
2025-02-18T08:54:09.004247+0100	2803305	3	Unknown Traffic	192.168.2.5	50269	92.255.85.36	9000	TCP
2025-02-18T08:54:12.206896+0100	2803305	3	Unknown Traffic	192.168.2.5	50273	92.255.85.36	9000	TCP
2025-02-18T08:54:13.816770+0100	2803305	3	Unknown Traffic	192.168.2.5	50275	92.255.85.36	9000	TCP
2025-02-18T08:54:14.713513+0100	2803305	3	Unknown Traffic	192.168.2.5	50276	92.255.85.36	9000	TCP
2025-02-18T08:54:15.505418+0100	2803305	3	Unknown Traffic	192.168.2.5	50277	92.255.85.36	9000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0Hw4Pw6xRd.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 0Hw4Pw6xRd.exe	Virustotal: Detection: 80%			Perma Link
Source: 0Hw4Pw6xRd.exe	ReversingLabs: Detection: 64%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E82B20 CryptUnprotectData,		0_2_06E82B20
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E82B18 CryptUnprotectData,		0_2_06E82B18

Source: 0Hw4Pw6xRd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 06E7A884h	0_2_06E7A256
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 06E78666h	0_2_06E7854F
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 06E78666h	0_2_06E78550
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 06E7A884h	0_2_06E7A860
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 07EEC7D2h	0_2_07EEBAE8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then mov eax, dword ptr [ebp-60h]	0_2_07EEBAE8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 07EECE45h	0_2_07EEBAE8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 07EE74E1h	0_2_07EE7048
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 4x nop then jmp 07EEA979h	0_2_07EEA961

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49705 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49716 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49709 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49711 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49712 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49710 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49717 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49708 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49706 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49707 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49744 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49752 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49715 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49791 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49713 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49803 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49714 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49719 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49731 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49779 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49737 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49833 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49845 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49767 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49815 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49809 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49851 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49773 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49839 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49725 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49827 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49864 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49821 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49870 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49876 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49914 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49882 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49926 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49932 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49785 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49760 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49920 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49938 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49944 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49956 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49950 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49797 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49974 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49888 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49857 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49962 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49968 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49994 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49987 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50016 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50023 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49999 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50031 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:49981 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50041 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50037 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50040 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50039 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50042 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50013 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50043 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50045 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50046 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50048 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50047 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50044 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50049 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50051 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50050 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50052 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50053 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50055 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50054 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50057 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50058 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50059 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50061 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50062 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50066 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50006 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50065 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50068 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50060 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50067 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50071 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50072 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50064 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50073 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50075 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50069 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50076 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50077 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50078 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50079 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50080 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50081 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50082 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50083 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50084 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50086 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50087 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50088 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50089 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50090 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50091 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50092 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50093 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50094 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50095 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50096 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50097 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50098 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50099 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50085 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50101 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50100 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50102 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50103 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50104 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50105 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50106 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50107 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50108 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50109 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50110 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50111 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50112 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50114 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50113 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50115 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50116 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50117 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50118 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50119 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50121 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50120 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50123 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50124 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50125 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50126 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50127 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50128 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50129 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50130 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50131 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50132 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50133 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50134 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50135 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50136 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50137 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50138 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50139 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50140 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50141 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50142 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50143 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50144 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50145 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50146 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50147 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50148 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50149 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50150 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50151 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50152 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50153 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50154 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50155 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50156 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50157 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50158 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50159 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50161 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50162 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50163 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50160 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50165 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50166 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50167 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50169 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50170 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50171 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50172 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50174 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50175 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50176 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50177 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50178 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50179 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50180 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50181 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50173 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50182 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50183 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50184 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50185 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50186 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50187 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50188 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50189 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50190 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50191 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50192 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50194 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50193 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50195 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50197 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50198 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50199 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50200 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50201 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50202 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50203 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50205 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50207 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50208 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50209 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50210 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50211 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50212 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50214 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50215 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50216 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50218 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50220 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50221 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50222 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50223 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50224 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50225 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50226 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50227 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50228 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50229 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50164 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50230 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50231 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50232 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50233 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50234 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50235 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50236 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50238 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50239 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50204 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50213 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50217 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50240 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50241 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50242 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50243 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50245 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50246 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50247 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50248 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50249 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50250 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50251 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50252 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50253 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50254 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50256 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50219 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50257 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50196 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50258 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50259 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50260 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50261 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50262 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50263 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50264 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50265 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50266 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50267 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50269 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50270 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50271 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50272 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50273 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50274 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50275 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50276 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50277 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50237 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50244 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.5:50255 -> 92.255.85.36:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 92.255.85.36 ports 9000,1,4,5,7,8,15847

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50211
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 50228 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50233

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 92.255.85.36:15847

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000

Source: Joe Sandbox View

ASN Name: SOVTEL-ASRU SOVTEL-ASRU

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49717 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49708 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49744 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49803 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49737 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49779 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49815 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49767 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49725 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49827 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49864 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49870 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49821 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49876 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49882 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49760 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49950 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49888 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49857 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49968 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49987 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50016 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49999 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50031 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50039 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50045 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50048 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50058 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50061 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50062 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50065 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50006 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50071 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50072 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50064 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50069 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50076 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50077 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50078 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50079 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50087 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50089 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50091 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50094 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50098 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50085 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50102 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50104 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50109 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50110 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50111 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50113 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50117 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50119 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50124 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50125 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50132 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50133 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50137 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50138 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50140 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50147 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50148 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50149 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50153 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50155 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50158 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50159 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50161 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50160 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50163 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50165 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50167 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50170 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50171 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50174 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50178 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50181 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50184 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50185 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50188 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50189 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50190 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50194 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50199 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50201 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50203 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50208 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50211 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50214 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50216 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50218 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50222 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50223 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50225 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50226 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50164 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50230 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50231 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50241 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50247 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50251 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50252 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50219 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50257 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50259 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50261 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50267 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50269 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50273 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50275 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50276 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50277 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50237 -> 92.255.85.36:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50255 -> 92.255.85.36:9000

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.36

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F HTTP/1.1Host: 92.255.85.36:9000

Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.36:9000
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.36:9000/wbinjget?q=9F196B497BDFD0CED832D4AB8AAC3B4F
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/DWCCqGB0
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4536563768.0000000003C50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 0Hw4Pw6xRd.exe, type: SAMPLE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 0.0.0Hw4Pw6xRd.exe.750000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_00CA0040	0_2_00CA0040
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_00CA0021	0_2_00CA0021
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_02999E78	0_2_02999E78
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0299B7C8	0_2_0299B7C8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_029954B8	0_2_029954B8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_02994B31	0_2_02994B31
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0299188E	0_2_0299188E
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0299D6EB	0_2_0299D6EB
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_02999E67	0_2_02999E67
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0299B7BA	0_2_0299B7BA
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0299D738	0_2_0299D738
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_02997750	0_2_02997750
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_02997740	0_2_02997740
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_02995488	0_2_02995488
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC5748	0_2_06CC5748
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CCAB60	0_2_06CCAB60
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC2B77	0_2_06CC2B77
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC04F0	0_2_06CC04F0
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC3096	0_2_06CC3096
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC4000	0_2_06CC4000
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC4D37	0_2_06CC4D37
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CCAB4B	0_2_06CCAB4B
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC6378	0_2_06CC6378
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC4B10	0_2_06CC4B10
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CC04E0	0_2_06CC04E0
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CCD9FE	0_2_06CCD9FE
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CCD9A7	0_2_06CCD9A7
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E725F8	0_2_06E725F8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E715C0	0_2_06E715C0
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E733F8	0_2_06E733F8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E740A8	0_2_06E740A8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E70040	0_2_06E70040
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E7B118	0_2_06E7B118
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E72B20	0_2_06E72B20
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E78800	0_2_06E78800
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E725F1	0_2_06E725F1
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E715B9	0_2_06E715B9
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E733F1	0_2_06E733F1
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E70039	0_2_06E70039
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E72B1D	0_2_06E72B1D
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E83648	0_2_06E83648
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8BF80	0_2_06E8BF80
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E88F30	0_2_06E88F30
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8AC60	0_2_06E8AC60
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E88470	0_2_06E88470
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E80040	0_2_06E80040
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8D830	0_2_06E8D830
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E85810	0_2_06E85810
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8F930	0_2_06E8F930
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E846A8	0_2_06E846A8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E846B8	0_2_06E846B8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E81629	0_2_06E81629
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E82E20	0_2_06E82E20
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E81638	0_2_06E81638
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8CB68	0_2_06E8CB68
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8A758	0_2_06E8A758
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E88F20	0_2_06E88F20
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8A4A8	0_2_06E8A4A8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8A49A	0_2_06E8A49A
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E88462	0_2_06E88462
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E87C48	0_2_06E87C48
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8D82D	0_2_06E8D82D
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E85801	0_2_06E85801
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E80006	0_2_06E80006
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8CDA8	0_2_06E8CDA8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8CDB8	0_2_06E8CDB8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8F928	0_2_06E8F928
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8F922	0_2_06E8F922
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E8F924	0_2_06E8F924
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0776BAE6	0_2_0776BAE6
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_0776B008	0_2_0776B008
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07761AF4	0_2_07761AF4
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE99C8	0_2_07EE99C8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE81A8	0_2_07EE81A8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE7510	0_2_07EE7510
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EEBAE8	0_2_07EEBAE8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EECED0	0_2_07EECED0
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE6660	0_2_07EE6660
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EEAC48	0_2_07EEAC48
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE13F8	0_2_07EE13F8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE8198	0_2_07EE8198
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EEBAD7	0_2_07EEBAD7
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE20A8	0_2_07EE20A8
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE20A0	0_2_07EE20A0
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE0A80	0_2_07EE0A80
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE209C	0_2_07EE209C
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE2098	0_2_07EE2098
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EEF290	0_2_07EEF290
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE3660	0_2_07EE3660
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE0040	0_2_07EE0040
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE3658	0_2_07EE3658
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE3655	0_2_07EE3655
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE3650	0_2_07EE3650
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EE6651	0_2_07EE6651
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EEAC37	0_2_07EEAC37
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_07EEE800	0_2_07EEE800
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CCDA08	0_2_06CCDA08

Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4539848108.0000000007129000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 0Hw4Pw6xRd.exe
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 0Hw4Pw6xRd.exe
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4531574440.0000000000CFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 0Hw4Pw6xRd.exe
Source: 0Hw4Pw6xRd.exe, 00000000.00000000.2076351911.0000000000810000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametttrgggrrrt.exe" vs 0Hw4Pw6xRd.exe
Source: 0Hw4Pw6xRd.exe	Binary or memory string: OriginalFilenametttrgggrrrt.exe" vs 0Hw4Pw6xRd.exe

Source: 0Hw4Pw6xRd.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0Hw4Pw6xRd.exe, type: SAMPLE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 0.0.0Hw4Pw6xRd.exe.750000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/36@0/1

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Mutant created: \Sessions\1\BaseNamedObjects\5c8947d1385c4e608aa7a0853c65418d

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9D26.tmp

Jump to behavior

Source: 0Hw4Pw6xRd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0Hw4Pw6xRd.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002F10000.00000004.00000800.00020000.00000000.sdmp, 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002EF9000.00000004.00000800.00020000.00000000.sdmp, 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.0000000002F1E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 0Hw4Pw6xRd.exe	Virustotal: Detection: 80%
Source: 0Hw4Pw6xRd.exe	ReversingLabs: Detection: 64%

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 0Hw4Pw6xRd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06CCC092 push esp; ret	0_2_06CCC099
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E772F5 push E871h; retf	0_2_06E772F9
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Code function: 0_2_06E7710A pushfd ; ret	0_2_06E77110

Source: 0Hw4Pw6xRd.exe

Static PE information: section name: .text entropy: 6.939591378361454

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50211
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 50228 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 50233

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Memory allocated: 2B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Memory allocated: 4B30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Window / User API: threadDelayed 2822			Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Window / User API: threadDelayed 6711			Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -36600s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -38741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -59765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -43173s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -40683s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -59546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -55751s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -59430s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -35985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 2804	Thread sleep time: -59328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -32183s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -48039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -33451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -55240s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -45040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -46226s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -56137s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 4028	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 5720	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -33150s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -32428s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -44551s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -52451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 1048	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -44592s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -37370s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -52446s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -41197s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -34569s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -59675s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -50173s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -33248s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -41890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe TID: 6552	Thread sleep time: -50315s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 36600	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 38741	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59765	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 43173	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 40683	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59546	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 55751	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59430	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 35985	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59328	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 32183	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 48039	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 33451	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 55240	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 45040	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 46226	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 56137	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 33150	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 32428	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 44551	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 52451	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 44592	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 37370	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 52446	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 41197	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 34569	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 59675	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 50173	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 33248	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 41890	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Thread delayed: delay time: 50315	Jump to behavior

Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4531574440.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4533211774.000000000312E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Users\user\Desktop\0Hw4Pw6xRd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 0Hw4Pw6xRd.exe, 00000000.00000002.4538252246.0000000006102000.00000004.00000020.00020000.00000000.sdmp, 0Hw4Pw6xRd.exe, 00000000.00000002.4538252246.00000000060E2000.00000004.00000020.00020000.00000000.sdmp, 0Hw4Pw6xRd.exe, 00000000.00000002.4538252246.0000000006149000.00000004.00000020.00020000.00000000.sdmp, 0Hw4Pw6xRd.exe, 00000000.00000002.4538252246.0000000006157000.00000004.00000020.00020000.00000000.sdmp, 0Hw4Pw6xRd.exe, 00000000.00000002.4531574440.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0Hw4Pw6xRd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0Hw4Pw6xRd.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2076261192.0000000000752000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532, type: MEMORYSTR

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\0Hw4Pw6xRd.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 0Hw4Pw6xRd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0Hw4Pw6xRd.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2076261192.0000000000752000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0Hw4Pw6xRd.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0Hw4Pw6xRd.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2076261192.0000000000752000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532, type: MEMORYSTR

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: 0Hw4Pw6xRd.exe PID: 6532, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	113 System Information Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0Hw4Pw6xRd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
0Hw4Pw6xRd.exe